3ba80718b5c68cf563db5bcda51606472b0b1e7bd52f9698383068cb935aad99

Reason

Machine shutdown

General

Target

chthonic_2.23.17.1.vir.exe
Size

151KB
MD5

aba6f9b372254cf34879ddc5283927c9
SHA1

f5724a63620621be8930972897da28c088547706
SHA256

3ba80718b5c68cf563db5bcda51606472b0b1e7bd52f9698383068cb935aad99
SHA512

a27be560684162fa3b315c6f7e90435c2e76a35a16e4e004d304d8569c4f22e56fa8711e12ea170e99592ba5f8715a2e26455bf7bc800d85e4aa7e96c87b9ede

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

chthonic_2.23.17.1.vir.exemsiexec.execmd.exeEWindowsMediaPlayer.exe

description	pid	process	target process
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 1100 wrote to memory of 840	1100	chthonic_2.23.17.1.vir.exe	msiexec.exe
PID 840 wrote to memory of 1448	840	msiexec.exe	cmd.exe
PID 840 wrote to memory of 1448	840	msiexec.exe	cmd.exe
PID 840 wrote to memory of 1448	840	msiexec.exe	cmd.exe
PID 840 wrote to memory of 1448	840	msiexec.exe	cmd.exe
PID 1448 wrote to memory of 272	1448	cmd.exe	EWindowsMediaPlayer.exe
PID 1448 wrote to memory of 272	1448	cmd.exe	EWindowsMediaPlayer.exe
PID 1448 wrote to memory of 272	1448	cmd.exe	EWindowsMediaPlayer.exe
PID 1448 wrote to memory of 272	1448	cmd.exe	EWindowsMediaPlayer.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe
PID 272 wrote to memory of 284	272	EWindowsMediaPlayer.exe	msiexec.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

msiexec.exe

pid process

840 msiexec.exe
Executes dropped EXE 1 IoCs

Processes:

EWindowsMediaPlayer.exe

pid process

272 EWindowsMediaPlayer.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

msiexec.exe

description pid process

Token: SeShutdownPrivilege 840 msiexec.exe
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

pid	process
840	msiexec.exe

pid	process
272	EWindowsMediaPlayer.exe

description	pid	process
Token: SeShutdownPrivilege	840	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 4 IoCs

Security Software Discovery

T1063

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\antivirservice	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

msiexec.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe
Deletes itself 1 IoCs

Processes:

msiexec.exe

pid process

840 msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

pid	process
840	msiexec.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe

Modifies registry class 23 IoCs

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe	msiexec.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\diagnosticshub.standardcollector.service	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\diagnosticshub.standardcollector.service\Start = "4"	msiexec.exe

Disables taskbar notifications via registry modification
evasion
Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

chthonic_2.23.17.1.vir.exemsiexec.exeEWindowsMediaPlayer.exe

pid process

1100 chthonic_2.23.17.1.vir.exe
840 msiexec.exe
272 EWindowsMediaPlayer.exe
Loads dropped DLL 6 IoCs

Processes:

chthonic_2.23.17.1.vir.exemsiexec.execmd.exeEWindowsMediaPlayer.exemsiexec.exe

pid process

1100 chthonic_2.23.17.1.vir.exe
840 msiexec.exe
1448 cmd.exe
1448 cmd.exe
272 EWindowsMediaPlayer.exe
284 msiexec.exe

pid	process
1100	chthonic_2.23.17.1.vir.exe
840	msiexec.exe
272	EWindowsMediaPlayer.exe

pid	process
1100	chthonic_2.23.17.1.vir.exe
840	msiexec.exe
1448	cmd.exe
1448	cmd.exe
272	EWindowsMediaPlayer.exe
284	msiexec.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\EWindowsMediaPlayer = "C:\\Users\\Admin\\AppData\\Roaming\\EWindowsMediaPlayer\\EWindowsMediaPlayer.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "system"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "system"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "AvastUI.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "AvastUI.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\software\microsoft\windows\currentversion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "system"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.17.1.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
PID:1100

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Deletes itself
- System policy modification
- Modifies registry class
- Modifies service
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1448

C:\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe
C:\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe
4⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Loads dropped DLL
PID:272

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe
5⤵
- Loads dropped DLL
PID:284

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1516

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1836

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Disabling Security Tools

1

T1089

Credential Access

Discovery

Security Software Discovery

1

T1063

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe

Download Submit
C:\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe

Download Submit
\Users\Admin\AppData\Local\Temp\2432.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\29AE.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\361C.tmp

Download Submit
\Users\Admin\AppData\Local\Temp\3A9F.tmp

Download Submit
\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe

Download Submit
\Users\Admin\AppData\Roaming\EWindowsMediaPlayer\EWindowsMediaPlayer.exe

Download Submit
memory/272-7-0x0000000000000000-mapping.dmp

Download
memory/284-10-0x0000000000000000-mapping.dmp

Download
memory/840-1-0x0000000000000000-mapping.dmp

Download
memory/1448-3-0x0000000000000000-mapping.dmp

Download
memory/1836-12-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/1836-13-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads