Overview

overview

10

Static

static

3

Trojan.Ransom.exe

windows7-x64

10

Resubmissions

12/03/2025, 21:38

250312-1g2k8atybt 10

09/03/2025, 00:43

250309-a3c7mswkz5 10

09/03/2025, 00:40

250309-a1jxeawvbx 10

Analysis

  • max time kernel
    117s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20241010-ja
  • resource tags

    arch:x64arch:x86image:win7-20241010-jalocale:ja-jpos:windows7-x64systemwindows
  • submitted
    09/03/2025, 00:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan.Ransom.exe

  • Size

    232KB

  • MD5

    60fabd1a2509b59831876d5e2aa71a6b

  • SHA1

    8b91f3c4f721cb04cc4974fc91056f397ae78faa

  • SHA256

    1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

  • SHA512

    3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

  • SSDEEP

    3072:BMhIBKH7j7DzQi7y5bvl4YAbdY9KWvwn7XHMzqEOf64CEEl64HBVdGXPKD:BMh5H7j5g54YZKXoxOuEEl64HZAi

Score
10/10
chimeradiscoveryransomwarespywarestealer

Malware Config

Signatures

  • Chimera 64 IoCs

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Chimera family
    chimera
  • Renames multiple (1983) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 37 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"
    1⤵
    • Chimera
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -k "C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:340
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1760
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:340 CREDAT:340994 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2924
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2160
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.HTML
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:332
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2272
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:2972
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\EditApprove.xhtml
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2092
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2252

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files\Java\jdk1.7.0_80\jre\YOUR_FILES_ARE_ENCRYPTED.HTML
        Filesize

        4KB

        MD5

        be50e72b4d1059c45921cca09b5fccf1

        SHA1

        7668fa079ae7d279f28d8e9b634120945b66f969

        SHA256

        264f4082b1d1449622600883481103b8a467cb26318471d4aaad707515d1395b

        SHA512

        6dc6dfafb84af6390e3b334a696cba4a253ce31b8e2d1ce8f1487d81db4692daf08efa5b588270fc6f0ca41de92b5483625b7d191faa6f4ff77520546511b84e

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B795D1F1-FC7F-11EF-9F88-5258AE25C632}.dat
        Filesize

        5KB

        MD5

        2c3aa2bb593ade84e4dafabc7dcc51e8

        SHA1

        f167a33f5dad18c587caedcc7645dacd9711169b

        SHA256

        cea509ab0564bdeb6daf2229e435b0c1c7259e09a633898fb23adc3667c499ad

        SHA512

        f85b68eae177a7b935ebc6d53f6770e9d306465e6a80a09272b4a6ff7fff82e5f18a1bad26f5a9b055866b15d1920fbbbe7dda57f95a1c044aace95adca3bdc4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{EE737ED0-86E5-11EF-B2CD-DAB21757C799}.dat
        Filesize

        5KB

        MD5

        626f67eb23015994caab9d4c6ea1f45e

        SHA1

        53099374e9d81cf8caa49e0a59feca0d44b5d7d8

        SHA256

        489d2d260db5f6ce2dd603d4a683fc59673acf1610b831c074f922fc0b156e50

        SHA512

        fe953ed65b4a3c37b01ce968630156eab45cf5ec658586251535f5d3da15dd87515d90c252a9f0a2eda0d55c107cfbbc7cd97d5b79265ecd88cc6eb7f20f4e25

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{A941AB14-FC7F-11EF-9F88-5258AE25C632}.dat
        Filesize

        4KB

        MD5

        34dafa4d08275eb9fb7658b460334e4e

        SHA1

        3df3794fe42a6b6ea2d26bf7a1fb395055b83727

        SHA256

        392510e5c59336393adaf47324e7451095609bf5c7f34ef4437d5f40f055eed1

        SHA512

        2e50c429f513a1c9a57d6be1afec90aeef9835f232fa5a7c624ba149a2d79dbe0a955ec1388defce829ed26e9926f8ee86fe7783eded17d15a7aa231948bb02e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\~DF4B2E4CFD99DAB84B.TMP
        Filesize

        16KB

        MD5

        5e532e8398578bb9ec49e445b2be72fb

        SHA1

        e25a714064c55bf87c281e2995046b8fdbe33ddc

        SHA256

        e1796ee30e49600ca6ebb1b108a96d35bbfd47c4400fca3b95815957121d3954

        SHA512

        d813d0a5781c6cdf5ad6986af321dbae99281dfaa360063cd3f2aa25bf7a117dd0bf6de3202f43133fcca6604ece6ce42c08f6352c3ada412a9a8dd084c1b883

        Download Submit

      • memory/2160-10-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2160-9-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2160-735-0x0000000140000000-0x00000001405E8000-memory.dmp

        Filesize

        5.9MB

        Download

      • memory/2888-0-0x0000000074A61000-0x0000000074A62000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2888-11-0x0000000000460000-0x000000000047A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2888-12-0x0000000074A60000-0x000000007500B000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2888-8-0x0000000074A60000-0x000000007500B000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2888-3-0x0000000010000000-0x0000000010010000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2888-2-0x0000000074A60000-0x000000007500B000-memory.dmp

        Filesize

        5.7MB

        Download

      • memory/2888-1-0x0000000074A60000-0x000000007500B000-memory.dmp

        Filesize

        5.7MB

        Download