Analysis
- max time kernel
149s - max time network
154s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 16:48
Static task
static1
Behavioral task
behavioral1
Sample
chthonic_2.23.12.3.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
chthonic_2.23.12.3.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target chthonic_2.23.12.3.vir.exe
- Size 192KB
- Sample200719-dkhc8vl45j
- SHA256 411476909242ea4f7115d4bf4a48730bdeec379b8ab00bf49fc64ee3b71eaeea
- MD5 f01cd09b5097e00e951b23c99bab4144
- SHA1 ba5539d69178ed9bea75bcdb47c8d7e4892c3693
- SHA512 ad1a0b4ff0b2affe516f847ac5a2f51bdc0a16a7fb1ed3b9f7c59e746e819eed28406b9cc1de6ec32588a31dcbc520eb9ad7d35f2505836ce6756329d1bd49d3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 772 wrote to memory of 3688 772 chthonic_2.23.12.3.vir.exe 66 PID 772 wrote to memory of 3688 772 chthonic_2.23.12.3.vir.exe 66 PID 772 wrote to memory of 3688 772 chthonic_2.23.12.3.vir.exe 66 PID 772 wrote to memory of 3688 772 chthonic_2.23.12.3.vir.exe 66 - Disables taskbar notifications via registry modification
- System policy modification 1 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" msiexec.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3688 msiexec.exe 3688 msiexec.exe 3688 msiexec.exe 3688 msiexec.exe 3688 msiexec.exe 3688 msiexec.exe 3688 msiexec.exe 3688 msiexec.exe - Blacklisted process makes network request 21 IoCs
flow pid Process 5 3688 msiexec.exe 6 3688 msiexec.exe 7 3688 msiexec.exe 8 3688 msiexec.exe 9 3688 msiexec.exe 10 3688 msiexec.exe 11 3688 msiexec.exe 17 3688 msiexec.exe 18 3688 msiexec.exe 21 3688 msiexec.exe 22 3688 msiexec.exe 23 3688 msiexec.exe 24 3688 msiexec.exe 25 3688 msiexec.exe 26 3688 msiexec.exe 27 3688 msiexec.exe 30 3688 msiexec.exe 31 3688 msiexec.exe 32 3688 msiexec.exe 33 3688 msiexec.exe 34 3688 msiexec.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\TGoogle = "C:\\ProgramData\\Google\\TGoogle.exe" msiexec.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.3.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- System policy modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Adds policy Run key to start application
- Modifies Internet Explorer settings
PID:3688
-