acb75f310d2f3e27e6abefec316c9f9c432bab3cf8ed7a8fecc59333e2df5657

General

Target
chthonic_2.23.11.11.vir.exe
Size 176KB
Sample200719-c4k8rcbjbj
SHA256 acb75f310d2f3e27e6abefec316c9f9c432bab3cf8ed7a8fecc59333e2df5657
MD5 bfc9f69fd742ae8c9a0b98496db341d7
SHA1 aa2c6cf2c1bb1a1f34dae8ff7bb27c7127f76fbf
SHA512 6b60bcd86f23b5ed26e89517c6627b54bfb7afcefb3a154150cb9e16f6cc8070295baa3c814f3c2708b2ad7e4bdfeb95422f63e44c237f421e67593709656aa5
MD5 SHA1 SHA512

Score

10^/10

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4056	1516	chthonic_2.23.11.11.vir.exe	66
PID 1516 wrote to memory of 4056	1516	chthonic_2.23.11.11.vir.exe	66
PID 1516 wrote to memory of 4056	1516	chthonic_2.23.11.11.vir.exe	66
PID 1516 wrote to memory of 4056	1516	chthonic_2.23.11.11.vir.exe	66

Suspicious behavior: EnumeratesProcesses 16 IoCs

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\InternetExplorerT = "C:\\ProgramData\\Internet Explorer\\InternetExplorerT.exe"	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.11.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.11.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Checks whether UAC is enabled
  - Adds policy Run key to start application
  - Modifies Internet Explorer settings
  - System policy modification
  PID:4056