3d990368ceffb435fd2163b10b1b463152d387967de24bd154b627ede96a0326

General

Target

chthonic_2.23.2.0.vir.exe
Size

230KB
MD5

b2d885727b999b505b91208cafbc1e38
SHA1

5144b51a951b132e5ffde6eebbf35de63e9f2b75
SHA256

3d990368ceffb435fd2163b10b1b463152d387967de24bd154b627ede96a0326
SHA512

f57404e880aa6dcdd22c77c3f0233918626a1e64d3c5b5aa7b0fee16bf9d8ba8c17fab9374fb5ed9efb38b919e277762bb4c70c44070e150d10cbc085aee901a

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WindowsPortableDevicesC = "C:\\ProgramData\\Windows Portable Devices\\WindowsPortableDevicesC.exe"	msiexec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

chthonic_2.23.2.0.vir.exe

description	pid	process	target process
PID 3900 wrote to memory of 776	3900	chthonic_2.23.2.0.vir.exe	msiexec.exe
PID 3900 wrote to memory of 776	3900	chthonic_2.23.2.0.vir.exe	msiexec.exe
PID 3900 wrote to memory of 776	3900	chthonic_2.23.2.0.vir.exe	msiexec.exe
PID 3900 wrote to memory of 776	3900	chthonic_2.23.2.0.vir.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

msiexec.exe

pid	process
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe
776	msiexec.exe

Disables taskbar notifications via registry modification
evasion

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.2.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.2.0.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3900

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Modifies Internet Explorer settings
- System policy modification
- Checks whether UAC is enabled
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:776