0e86fbf5aa4f23d453805ab455d1ce53cecdf83bbdf142d995cf61290e8caab4

General

Target

chthonic_2.23.11.0.vir.exe
Size

361KB
MD5

a6a625b1840483a2288b7c93991a12ed
SHA1

1845a9543a84ce21532a2a5df5200fdba8db8cea
SHA256

0e86fbf5aa4f23d453805ab455d1ce53cecdf83bbdf142d995cf61290e8caab4
SHA512

9229defc208590b2e0f182d18a68d520f84703b698b098688f6da025e9c3a8328c6916093027805f99e56097ddc1932ddcaab460b5dab4b003fff392858e0dbc

Score

10^/10

evasion trojan persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

chthonic_2.23.11.0.vir.exe

description	pid	process
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe
Token: 0	1496	chthonic_2.23.11.0.vir.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exe

pid process

2028 msiexec.exe
2028 msiexec.exe
2028 msiexec.exe
2028 msiexec.exe
2028 msiexec.exe
2028 msiexec.exe
Disables taskbar notifications via registry modification
evasion

pid	process
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\Explorer	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoNotification = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yWindowsPhotoViewer = "C:\\ProgramData\\Windows Photo Viewer\\yWindowsPhotoViewer.exe"	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

chthonic_2.23.11.0.vir.exe

description	pid	process	target process
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe
PID 1496 wrote to memory of 2028	1496	chthonic_2.23.11.0.vir.exe	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msiexec.exe

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.0.vir.exe
"C:\Users\Admin\AppData\Local\Temp\chthonic_2.23.11.0.vir.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- System policy modification
- Adds policy Run key to start application
- Modifies Internet Explorer settings
- Checks whether UAC is enabled
PID:2028