Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows10_x64 -
resource
win10 -
submitted
19-07-2020 17:32
Static task
static1
Behavioral task
behavioral1
Sample
chthonic_2.23.11.3.vir.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
chthonic_2.23.11.3.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
chthonic_2.23.11.3.vir.exe
-
Size
229KB
-
MD5
a7ff128bb60cde180d2eea63313f59bb
-
SHA1
32b93a7c8d901cfc6ee01fd0f1110e2cc9b9deed
-
SHA256
e097234f7020f7f728106ac2648d5a77f19004bdea67c3f14a6b373575bf7af2
-
SHA512
800d9f861a0314b2515961a4ff859490544c95ef5683803e6e6c890675b4c1d6df496e0e04236513d495685554f7b5cd1fb0733839dbe71e66649cf48b435c64
Score
10/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chthonic_2.23.11.3.vir.exedescription pid process Token: 0 3908 chthonic_2.23.11.3.vir.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msiexec.exepid process 4024 msiexec.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CReferenceAssemblies = "C:\\ProgramData\\Reference Assemblies\\CReferenceAssemblies.exe" msiexec.exe -
Disables taskbar notifications via registry modification
-
Processes:
msiexec.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" msiexec.exe -
System policy modification 1 TTPs 5 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" msiexec.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
chthonic_2.23.11.3.vir.exedescription pid process target process PID 3908 wrote to memory of 4024 3908 chthonic_2.23.11.3.vir.exe msiexec.exe PID 3908 wrote to memory of 4024 3908 chthonic_2.23.11.3.vir.exe msiexec.exe PID 3908 wrote to memory of 4024 3908 chthonic_2.23.11.3.vir.exe msiexec.exe PID 3908 wrote to memory of 4024 3908 chthonic_2.23.11.3.vir.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
msiexec.exepid process 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe 4024 msiexec.exe -
Processes:
msiexec.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.3.vir.exe"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.3.vir.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4024-0-0x0000000000000000-mapping.dmp