Overview

overview

10

Static

static

3

Trojan.Ransom.exe

windows10-2004-x64

10

Resubmissions

12/03/2025, 21:38

250312-1g2k8atybt 10

09/03/2025, 00:43

250309-a3c7mswkz5 10

09/03/2025, 00:40

250309-a1jxeawvbx 10

Analysis

  • max time kernel
    126s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2025, 00:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan.Ransom.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeradiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Chimera family
    chimera
  • Renames multiple (3272) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 27 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"
    1⤵
    • Chimera
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1148
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Music\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:5720
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5720 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:5904
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8121046f8,0x7ff812104708,0x7ff812104718
      2⤵
        PID:4064
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        2⤵
          PID:4080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2584
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
          2⤵
            PID:3116
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
            2⤵
              PID:3832
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              2⤵
                PID:4900
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
                2⤵
                  PID:4764
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2452
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                  2⤵
                    PID:2472
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
                    2⤵
                      PID:4392
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                      2⤵
                        PID:1648
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11118770716455968197,2748713382227487508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                        2⤵
                          PID:3832
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4452
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2784

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files\Java\jdk-1.8\jre\lib\YOUR_FILES_ARE_ENCRYPTED.HTML
                            Filesize

                            4KB

                            MD5

                            fdd6da9f303cd0462c42aa283ecb84b5

                            SHA1

                            93992a57a8662ebf98748863e337f02552f72648

                            SHA256

                            6221bffe467d08cf13086602358714bfac497909b7e10924c09088f27f1cc332

                            SHA512

                            908452d14e56bdde747ea2d9eaeddb50681221b87bdce2d12a286eebd1a16389c032b2f795bb2d5f9ab456b39b472a50415936cad037801c0613c15f97eb057f

                            Download Submit

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
                            Filesize

                            4KB

                            MD5

                            da597791be3b6e732f0bc8b20e38ee62

                            SHA1

                            1125c45d285c360542027d7554a5c442288974de

                            SHA256

                            5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

                            SHA512

                            d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1fe52595-0465-458b-a447-13ee1071df15.tmp
                            Filesize

                            11KB

                            MD5

                            4bf507a82ea77ddef9104fac6ac3b4d0

                            SHA1

                            76beef72df9bf963c0f355bd58c25f5b8e76733e

                            SHA256

                            c6fcd6a4ec319eb65bbe5a5a33c855a736fc036674e5e8d43ba1fe85d4bf62b3

                            SHA512

                            c6eb90cd1dfe5cf6e1e6773f5263886ac49c2adb0f26b8a588a57541372b23280afc33402e58a44cbcd99f6dbe6fa315fd03157f41fafb2a59b90f0bdf96fa75

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            94bd9c36e88be77b106069e32ac8d934

                            SHA1

                            32bd157b84cde4eaf93360112d707056fc5b0b86

                            SHA256

                            8f49a43a08e2984636b172a777d5b3880e6e82ad25b427fef3f05b7b4f5c5b27

                            SHA512

                            7d4933fae6a279cc330fde4ae9425f66478c166684a30cec9c5c3f295289cf83cbdf604b8958f6db64b0a4b1566db102fbcbdcdb6eca008d86d9a9c8b252ff16

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                            Filesize

                            329B

                            MD5

                            2ef79696d3e6984c08b81bd15f169b4e

                            SHA1

                            84560e4640e1ae8a556d89863c37e9979c5af57c

                            SHA256

                            539e9a2b56aba0ef638b64b73b81cb071243e628c6769cac13cf812937eaa68b

                            SHA512

                            e5fb5ea928769079ad6210f61be8fe6ba57ef5e2f304dee7fcefa44dbd988ecb644ef2c9c4f2118b2994d8299e4492200b29922b00f92628e22a9902f89384e3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            5KB

                            MD5

                            e1eb938b39009b3cfcc11a2fc5d1d69c

                            SHA1

                            f61ecfd3bf4d057e448ea038dbca03b6e0ad95f9

                            SHA256

                            b064d21fc01789f55d9859032cf10d30a431ecc6d7d491db1b5022916a2f4342

                            SHA512

                            f2b44f77450bdc222e8615e30974ad0c9b7ad47e28fe9c17a9844cce0e3059d22926351b054a6fd5f8896e6cd3ef258dbc2867eccc21f95345d83358620b46da

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            6KB

                            MD5

                            849c6bb6ead3dfc451b81a82625cdc4e

                            SHA1

                            657678920ba6c5959024a4c6ab01b5c9070d191b

                            SHA256

                            9e494184ad98844e407afb03290ff3e8038c6661e59b4f228c31812080739ebf

                            SHA512

                            f9337533ee65ffa7596732b42b17cc298dfbc7979446adfc1038eb6ac9c91e283e0f225d39d9b2b1eea2d4925226db2a67196ecd7468886575d30f21e7a7ec9a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                            Filesize

                            16B

                            MD5

                            206702161f94c5cd39fadd03f4014d98

                            SHA1

                            bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                            SHA256

                            1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                            SHA512

                            0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            ce30b7a4afe47fe4eca7533296bcacb9

                            SHA1

                            9876b73d581fa635b50f18d1e96987f569d26ac7

                            SHA256

                            dcbce16ac005642f852c59723ead7caea894d9618614f13b84b7928ad03067d5

                            SHA512

                            abfee53970b2c7319946b0f911a9a230c9d121a25a40bd349c6009e5e8538b3fa848e0c08c7ddbabd972260474107f7b845b891454f2c47ae80bbf075d0dabce

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            11KB

                            MD5

                            65cef15a83b464c9b0ff0080b04edfce

                            SHA1

                            2dbb6af8e697434749e59bf7bbe22cd422989d80

                            SHA256

                            1cf6bb76ae8a24d09bc3c7372e1f256bc26c0ad5c357186ef66f7553ddb614cb

                            SHA512

                            b978babd70e66e59161c8f498e4d9983390fd0c539c2e2fc2daa4ea668c6840ba1f339d51a9208dc3f68d9e335e219244a9d73e84221bd9ea1f67cf24b894f41

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MPZT1JWX\suggestions[1].en-US
                            Filesize

                            17KB

                            MD5

                            5a34cb996293fde2cb7a4ac89587393a

                            SHA1

                            3c96c993500690d1a77873cd62bc639b3a10653f

                            SHA256

                            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                            SHA512

                            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                            Download Submit

                          • memory/1148-0-0x0000000074FF2000-0x0000000074FF3000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1148-629-0x0000000074FF2000-0x0000000074FF3000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1148-630-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                            Filesize

                            5.7MB

                            Download

                          • memory/1148-9-0x0000000005670000-0x000000000568A000-memory.dmp

                            Filesize

                            104KB

                            Download

                          • memory/1148-8-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                            Filesize

                            5.7MB

                            Download

                          • memory/1148-4-0x0000000010000000-0x0000000010010000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1148-2-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                            Filesize

                            5.7MB

                            Download

                          • memory/1148-1-0x0000000074FF0000-0x00000000755A1000-memory.dmp

                            Filesize

                            5.7MB

                            Download