fbb2bd240480bb95058a522c0144b6704691bed1fd932f1978c3283d03aea882

General

Target

chthonic_2.23.11.2.vir.exe
Size

300KB
MD5

65960d4d59689ca0985d938f6896161a
SHA1

5e5adededfa5a1401c4bc42bd639a33f29d74766
SHA256

fbb2bd240480bb95058a522c0144b6704691bed1fd932f1978c3283d03aea882
SHA512

2bd773d37c46653dc71a176ed2b4c551c3dc6471beb99122ac3a92371c8fcdf24a242d5a154a4be9c05c5e4166a19024f025664525232fcb05cbfce576047f4d

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

chthonic_2.23.11.2.vir.exe

description	pid	process	target process
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe
PID 1156 wrote to memory of 1192	1156	chthonic_2.23.11.2.vir.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

msiexec.exe

pid process

1192 msiexec.exe
1192 msiexec.exe
1192 msiexec.exe
1192 msiexec.exe
1192 msiexec.exe
1192 msiexec.exe
1192 msiexec.exe
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

pid	process
1192	msiexec.exe
1192	msiexec.exe
1192	msiexec.exe
1192	msiexec.exe
1192	msiexec.exe
1192	msiexec.exe
1192	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

chthonic_2.23.11.2.vir.exe

pid process

1156 chthonic_2.23.11.2.vir.exe
1156 chthonic_2.23.11.2.vir.exe

pid	process
1156	chthonic_2.23.11.2.vir.exe
1156	chthonic_2.23.11.2.vir.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MicrosoftAnalysisServicesW = "C:\\ProgramData\\Microsoft Analysis Services\\MicrosoftAnalysisServicesW.exe"	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.2.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.2.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
PID:1156

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
- System policy modification
- Adds policy Run key to start application
- Modifies Internet Explorer settings
PID:1192