c79649b70f1680062355e956dcabe0fa2ecb58faf5c22d4454a3dbb67e1db6b7

General

Target

chthonic_2.23.11.7.vir.exe
Size

147KB
MD5

da35953c97d7ae09edc85da33296e993
SHA1

b545abc8bce08d197f38512062391152ee859ade
SHA256

c79649b70f1680062355e956dcabe0fa2ecb58faf5c22d4454a3dbb67e1db6b7
SHA512

26856d338a4f71151f448ffc805176d294aaf7e248de6d3c54a1b69f054a7fa10530b6f4a3ff33c261a5533e130f16ea994660354762fe3cf959f726c7d4bc15

Score

10^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

msiexec.exe

pid process

1068 msiexec.exe
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

pid	process
1068	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

Modify Registry

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

chthonic_2.23.11.7.vir.exe

description	pid	process	target process
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe
PID 1124 wrote to memory of 1068	1124	chthonic_2.23.11.7.vir.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exe

pid process

1068 msiexec.exe
1068 msiexec.exe
1068 msiexec.exe
1068 msiexec.exe
1068 msiexec.exe
1068 msiexec.exe
1068 msiexec.exe
1068 msiexec.exe
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Adds policy Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WWindowsPowerShell = "C:\\ProgramData\\WindowsPowerShell\\WWindowsPowerShell.exe"	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.7.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.7.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1124