fbb2bd240480bb95058a522c0144b6704691bed1fd932f1978c3283d03aea882

General

Target
chthonic_2.23.11.2.vir.exe
Size 300KB
Sample200719-84z75jspaa
SHA256 fbb2bd240480bb95058a522c0144b6704691bed1fd932f1978c3283d03aea882
MD5 65960d4d59689ca0985d938f6896161a
SHA1 5e5adededfa5a1401c4bc42bd639a33f29d74766
SHA512 2bd773d37c46653dc71a176ed2b4c551c3dc6471beb99122ac3a92371c8fcdf24a242d5a154a4be9c05c5e4166a19024f025664525232fcb05cbfce576047f4d
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4060	3588	chthonic_2.23.11.2.vir.exe	67
PID 3588 wrote to memory of 4060	3588	chthonic_2.23.11.2.vir.exe	67
PID 3588 wrote to memory of 4060	3588	chthonic_2.23.11.2.vir.exe	67
PID 3588 wrote to memory of 4060	3588	chthonic_2.23.11.2.vir.exe	67

Adds policy Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ReferenceAssembliesY = "C:\\ProgramData\\Reference Assemblies\\ReferenceAssembliesY.exe"	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3588	chthonic_2.23.11.2.vir.exe
3588	chthonic_2.23.11.2.vir.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs