Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
chthonic_2.4.22.0.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
chthonic_2.4.22.0.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target chthonic_2.4.22.0.vir.exe
- Size 188KB
- Sample200719-dmehhhs5da
- SHA256 46731281d5af0a524cbc8e459d1a5cd56b64caa9aec824902e53dfb9ccc021df
- MD5 3e20db8b47324b00afb542603e7ea98f
- SHA1 3df96a679207e82599fac13d707d98829ebd69a3
- SHA512 8a958c54ae222877ee123271bca85378545510543c729e290d07f70657865ba4f8c78e60d3a2a4f2f45c39e43e9ed6e8f8de71eff4400daef8979eb4721b42f2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 2532 wrote to memory of 3844 2532 chthonic_2.4.22.0.vir.exe 67 PID 3844 wrote to memory of 3952 3844 chthonic_2.4.22.0.vir.exe 68 PID 3844 wrote to memory of 3952 3844 chthonic_2.4.22.0.vir.exe 68 PID 3844 wrote to memory of 3952 3844 chthonic_2.4.22.0.vir.exe 68 PID 3844 wrote to memory of 3952 3844 chthonic_2.4.22.0.vir.exe 68 -
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe - Disables taskbar notifications via registry modification
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\AgentWindowsSidebar = "C:\\ProgramData\\Windows Sidebar\\AgentWindowsSidebar.exe" msiexec.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2532 chthonic_2.4.22.0.vir.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2532 set thread context of 3844 2532 chthonic_2.4.22.0.vir.exe 67 - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe 3952 msiexec.exe - Deletes itself 1 IoCs
pid Process 3952 msiexec.exe - System policy modification 1 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" msiexec.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.22.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.22.0.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Suspicious use of SetThreadContext
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.22.0.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.4.22.0.vir.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Modifies Internet Explorer settings
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Deletes itself
- System policy modification
- Checks whether UAC is enabled
PID:3952
-
-