dd606ae6958876b227db36ee7cb13a25f316810da59ffc2c5d7dc09b4bc2b7dc

Analysis

max time kernel
12s
max time network
25s
platform
windows7_x64
resource
win7v200430
submitted
19/07/2020, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
chthonic_2.23.17.9.vir.exe
Size 314KB
Sample200719-34pdjm5gla
SHA256 dd606ae6958876b227db36ee7cb13a25f316810da59ffc2c5d7dc09b4bc2b7dc
MD5 709f1e642e5ae9893fa4c95d7a78190c
SHA1 ec2e35e2baa1bbc6f6f1580f7000b097ff120569
SHA512 a2217946d05c8660c22e466e5dd09e35b50f3d398661964047622635af4070704b7801696b2c664df98d3b3ff47f9c8d0001eeae561f842f6b7ba34bfa9eeb96
MD5 SHA1 SHA512

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
1408	chthonic_2.23.17.9.vir.exe
1460	msiexec.exe
1092	WindowsPhotoViewere.com
1756	msiexec.exe

Loads dropped DLL 6 IoCs

pid	Process
1408	chthonic_2.23.17.9.vir.exe
1460	msiexec.exe
788	cmd.exe
788	cmd.exe
1092	WindowsPhotoViewere.com
1756	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1092	WindowsPhotoViewere.com

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "system"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "AvastUI.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "AvastUI.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsPhotoViewere = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsPhotoViewere\\WindowsPhotoViewere.com"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "system"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	msiexec.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\diagnosticshub.standardcollector.service	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\diagnosticshub.standardcollector.service\Start = "4"	msiexec.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1488	1408	chthonic_2.23.17.9.vir.exe	25
PID 1408 wrote to memory of 1460	1408	chthonic_2.23.17.9.vir.exe	24
PID 1460 wrote to memory of 788	1460	msiexec.exe	26
PID 1460 wrote to memory of 788	1460	msiexec.exe	26
PID 1460 wrote to memory of 788	1460	msiexec.exe	26
PID 1460 wrote to memory of 788	1460	msiexec.exe	26
PID 788 wrote to memory of 1092	788	cmd.exe	28
PID 788 wrote to memory of 1092	788	cmd.exe	28
PID 788 wrote to memory of 1092	788	cmd.exe	28
PID 788 wrote to memory of 1092	788	cmd.exe	28
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1764	1092	WindowsPhotoViewere.com	32
PID 1092 wrote to memory of 1756	1092	WindowsPhotoViewere.com	31

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1460	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software	msiexec.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1408	chthonic_2.23.17.9.vir.exe
1092	WindowsPhotoViewere.com

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1460	msiexec.exe

Deletes itself 1 IoCs

pid	Process
1460	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.9.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.9.vir.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious use of UnmapMainImage
PID:1408
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\system32\msiexec.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Modifies service
  - Suspicious use of WriteProcessMemory
  - Suspicious use of AdjustPrivilegeToken
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Deletes itself
  - System policy modification
  - Modifies Internet Explorer settings
  PID:1460
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\WindowsPhotoViewere\WindowsPhotoViewere.com"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Users\Admin\AppData\Roaming\WindowsPhotoViewere\WindowsPhotoViewere.com
      C:\Users\Admin\AppData\Roaming\WindowsPhotoViewere\WindowsPhotoViewere.com
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Loads dropped DLL
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      Suspicious use of UnmapMainImage
      PID:1092
    - - C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\system32\msiexec.exe
        5⤵
        Suspicious behavior: GetForegroundWindowSpam
        Loads dropped DLL
        
        PID:1756
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        
        PID:1764
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe"
  2⤵
  PID:1488

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1016

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-12-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads