Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    22/02/2024, 19:49

General

  • Target

    Chimera-1.4/lib/__init__.py

  • Size

    213B

  • MD5

    dadb49ee09a46603666dfc8f206e2a43

  • SHA1

    b734d7ade2ce07096e7e31ec82420306897bb748

  • SHA256

    dca8b569bbe2c59ed64da7285bd43ae5832764f5c5a6e531e4d7837f08649ce8

  • SHA512

    1c898855fdb7e298a9abcc4d7802273b19b911222ea4cdbf018743b5eb51dddd546f5bf10c4e40c4553c49e12c9b3728d92f619ae194f033ccd6e32ef328982e

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\lib\__init__.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\lib\__init__.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Chimera-1.4\lib\__init__.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    6d3811e942495d459f8aa3635f0533ae

    SHA1

    4577eb36637ed5cd0444ecc9569d88c2e98732c4

    SHA256

    75104d7681a270ce1dc5ae1e388cec14eafc898332dbd4ea3794e4eb17d4ed76

    SHA512

    04201640b00d8d79ffbada434c2d358b7d5da3e634ce831b950afc4022e0a8f8ed0a6ccfcc50c104744253c0bee66ca09ba29279965ddb236afc4a7e9f461600