Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

SchoolBoy Runaway.exe

windows10-ltsc 2021-x64

10

Resubmissions

05/03/2025, 22:13

250305-142jqs1nz2 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SchoolBoy Runaway.exe

  • Size

    635KB

  • Sample

    250305-142jqs1nz2

  • MD5

    c66114e4978c9d4471f950928b0e2f9d

  • SHA1

    1dee05ddcbf6f449d07e5f82a8bedd5c5e5452f9

  • SHA256

    a8683d722ba537caef48839be7a454fcb9a190aaa06c092daa5e9f92686b35db

  • SHA512

    e066d1a3061b50ad0d1420c2813069d6843920e6262f9ececa35a4a066f31060c51ccb5ea2caf59e39de3f3752fdf291b7725fb01abe2d73f1324125fbe4a563

  • SSDEEP

    12288:UKQGzu2BFhnkCYEABNdL7urYP1DqcKoYRC3zC12KZvIZX:UKZkD3L7urYP1DtKoYRCQ2KZvE

Score
10/10
chimeradiscoverypersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      SchoolBoy Runaway.exe

    • Size

      635KB

    • MD5

      c66114e4978c9d4471f950928b0e2f9d

    • SHA1

      1dee05ddcbf6f449d07e5f82a8bedd5c5e5452f9

    • SHA256

      a8683d722ba537caef48839be7a454fcb9a190aaa06c092daa5e9f92686b35db

    • SHA512

      e066d1a3061b50ad0d1420c2813069d6843920e6262f9ececa35a4a066f31060c51ccb5ea2caf59e39de3f3752fdf291b7725fb01abe2d73f1324125fbe4a563

    • SSDEEP

      12288:UKQGzu2BFhnkCYEABNdL7urYP1DqcKoYRC3zC12KZvIZX:UKZkD3L7urYP1DtKoYRCQ2KZvE

    Score
    10/10
    chimeradiscoverypersistenceransomwarespywarestealer

    • Chimera

      Ransomware which infects local and network files, often distributed via Dropbox links.

      ransomwarechimera

    • Chimera Ransomware Loader DLL

      Drops/unpacks executable file which resembles Chimera's Loader.dll.

      ransomware

    • Chimera family

      chimera

    • Renames multiple (3279) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks