4480bcbacb98c86980a5d9bd9f62ccc286e2e0e3bf5696991b37720648dcb186

General

Target

chthonic_2.23.12.1.vir.exe
Size

188KB
MD5

fef16df968936d5d5a0c9972aba5ff23
SHA1

52caaf61150ce8ea9a2fd7a20bd0e233936a0563
SHA256

4480bcbacb98c86980a5d9bd9f62ccc286e2e0e3bf5696991b37720648dcb186
SHA512

f51b9e2405398c6d3f20dfac542b4b3f9679f31f028339fb59fae64a20b2ae17f9024c8d764dec7e0bc83e5bfbfdce90a5d8ce75775eb8f7e7bac1640f74941e

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

chthonic_2.23.12.1.vir.exe

description	pid	process	target process
PID 748 wrote to memory of 588	748	chthonic_2.23.12.1.vir.exe	msiexec.exe
PID 748 wrote to memory of 588	748	chthonic_2.23.12.1.vir.exe	msiexec.exe
PID 748 wrote to memory of 588	748	chthonic_2.23.12.1.vir.exe	msiexec.exe
PID 748 wrote to memory of 588	748	chthonic_2.23.12.1.vir.exe	msiexec.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rWindowsPhotoViewer = "C:\\ProgramData\\Windows Photo Viewer\\rWindowsPhotoViewer.exe"	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msiexec.exe

pid process

588 msiexec.exe
588 msiexec.exe
588 msiexec.exe
588 msiexec.exe
588 msiexec.exe
588 msiexec.exe
588 msiexec.exe
588 msiexec.exe

pid	process
588	msiexec.exe
588	msiexec.exe
588	msiexec.exe
588	msiexec.exe
588	msiexec.exe
588	msiexec.exe
588	msiexec.exe
588	msiexec.exe

Blacklisted process makes network request 21 IoCs

Processes:

msiexec.exe

flow	pid	process
4	588	msiexec.exe
5	588	msiexec.exe
6	588	msiexec.exe
7	588	msiexec.exe
8	588	msiexec.exe
9	588	msiexec.exe
10	588	msiexec.exe
12	588	msiexec.exe
13	588	msiexec.exe
18	588	msiexec.exe
19	588	msiexec.exe
20	588	msiexec.exe
21	588	msiexec.exe
22	588	msiexec.exe
23	588	msiexec.exe
24	588	msiexec.exe
25	588	msiexec.exe
26	588	msiexec.exe
27	588	msiexec.exe
28	588	msiexec.exe
29	588	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.1.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.12.1.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- System policy modification
- Checks whether UAC is enabled
PID:588