Analysis
- max time kernel
147s - max time network
138s - platform
windows7_x64 - resource
win7v200430 - submitted
19/07/2020, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
chthonic_2.23.12.3.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
chthonic_2.23.12.3.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target chthonic_2.23.12.3.vir.exe
- Size 192KB
- Sample200719-dkhc8vl45j
- SHA256 411476909242ea4f7115d4bf4a48730bdeec379b8ab00bf49fc64ee3b71eaeea
- MD5 f01cd09b5097e00e951b23c99bab4144
- SHA1 ba5539d69178ed9bea75bcdb47c8d7e4892c3693
- SHA512 ad1a0b4ff0b2affe516f847ac5a2f51bdc0a16a7fb1ed3b9f7c59e746e819eed28406b9cc1de6ec32588a31dcbc520eb9ad7d35f2505836ce6756329d1bd49d3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 PID 1296 wrote to memory of 868 1296 chthonic_2.23.12.3.vir.exe 24 - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 868 msiexec.exe 868 msiexec.exe 868 msiexec.exe - Deletes itself 1 IoCs
pid Process 868 msiexec.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tWindowsPowerShell = "C:\\ProgramData\\WindowsPowerShell\\tWindowsPowerShell.exe" msiexec.exe - Disables taskbar notifications via registry modification
- System policy modification 1 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" msiexec.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe - Blacklisted process makes network request 13 IoCs
flow pid Process 1 868 msiexec.exe 2 868 msiexec.exe 5 868 msiexec.exe 6 868 msiexec.exe 7 868 msiexec.exe 8 868 msiexec.exe 9 868 msiexec.exe 11 868 msiexec.exe 12 868 msiexec.exe 13 868 msiexec.exe 14 868 msiexec.exe 15 868 msiexec.exe 16 868 msiexec.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.3.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Deletes itself
- Adds policy Run key to start application
- System policy modification
- Checks whether UAC is enabled
- Blacklisted process makes network request
- Modifies Internet Explorer settings
PID:868
-