35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1

Reason

Machine shutdown

General

Target

chthonic_2.23.17.5.vir.exe
Size

120KB
MD5

20634b0d4225cd3d911daf828cb6aa39
SHA1

d396236df73c7d15cf910d6ce3ff4bb75d7e1ebe
SHA256

35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1
SHA512

5485eea7b0b1f97c3384607c84e71a6a795653f5d802c8269c134a8f4596f5971334893282ade9e8e5f4765b8919793f74147155595ef27b24b7d7d371898668

Score

10^/10

persistence evasion trojan

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

chthonic_2.23.17.5.vir.exemsiexec.exeAMSBuild.exemsiexec.exe

pid process

1500 chthonic_2.23.17.5.vir.exe
364 msiexec.exe
1064 AMSBuild.exe
1552 msiexec.exe
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Disables taskbar notifications via registry modification
evasion
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

msiexec.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe

pid	process
1500	chthonic_2.23.17.5.vir.exe
364	msiexec.exe
1064	AMSBuild.exe
1552	msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\diagnosticshub.standardcollector.service	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\diagnosticshub.standardcollector.service\Start = "4"	msiexec.exe

Loads dropped DLL 6 IoCs

Processes:

chthonic_2.23.17.5.vir.exemsiexec.execmd.exeAMSBuild.exemsiexec.exe

pid process

1500 chthonic_2.23.17.5.vir.exe
364 msiexec.exe
452 cmd.exe
452 cmd.exe
1064 AMSBuild.exe
1552 msiexec.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msiexec.exe

pid process

364 msiexec.exe
Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

364 msiexec.exe

pid	process
1500	chthonic_2.23.17.5.vir.exe
364	msiexec.exe
452	cmd.exe
452	cmd.exe
1064	AMSBuild.exe
1552	msiexec.exe

pid	process
364	msiexec.exe

pid	process
364	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

AMSBuild.exe

pid process

1064 AMSBuild.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msiexec.exe

description pid process

Token: SeShutdownPrivilege 364 msiexec.exe

pid	process
1064	AMSBuild.exe

description	pid	process
Token: SeShutdownPrivilege	364	msiexec.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "system"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "system"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "AvastUI.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "AvastUI.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\AMSBuild = "C:\\Users\\Admin\\AppData\\Roaming\\AMSBuild\\AMSBuild.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

chthonic_2.23.17.5.vir.exemsiexec.execmd.exeAMSBuild.exe

description	pid	process	target process
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 1500 wrote to memory of 364	1500	chthonic_2.23.17.5.vir.exe	msiexec.exe
PID 364 wrote to memory of 452	364	msiexec.exe	cmd.exe
PID 364 wrote to memory of 452	364	msiexec.exe	cmd.exe
PID 364 wrote to memory of 452	364	msiexec.exe	cmd.exe
PID 364 wrote to memory of 452	364	msiexec.exe	cmd.exe
PID 452 wrote to memory of 1064	452	cmd.exe	AMSBuild.exe
PID 452 wrote to memory of 1064	452	cmd.exe	AMSBuild.exe
PID 452 wrote to memory of 1064	452	cmd.exe	AMSBuild.exe
PID 452 wrote to memory of 1064	452	cmd.exe	AMSBuild.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe
PID 1064 wrote to memory of 1552	1064	AMSBuild.exe	msiexec.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.5.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.5.vir.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies service
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Deletes itself
- Checks for any installed AV software in registry
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
- System policy modification
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:364

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:452

C:\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe
C:\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe
4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
5⤵
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
PID:1552

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1816

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1736

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Disabling Security Tools

1

T1089

Credential Access

Discovery

System Information Discovery

1

T1082

Security Software Discovery

1

T1063

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe

Download Submit
C:\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe

Download Submit
\Users\Admin\AppData\Local\Temp\750F.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\955B.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\A533.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\C300.tmp

Download Submit
\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe

Download Submit
\Users\Admin\AppData\Roaming\AMSBuild\AMSBuild.exe

Download Submit
memory/364-1-0x0000000000000000-mapping.dmp

Download
memory/452-3-0x0000000000000000-mapping.dmp

Download
memory/1064-7-0x0000000000000000-mapping.dmp

Download
memory/1552-10-0x0000000000000000-mapping.dmp

Download
memory/1736-12-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1736-21-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1736-23-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/1736-24-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads