30acb23863a1043c7210c8fb75236fce5111bef305c6574e518e9d0e50d740cf

Resubmissions

02/03/2024, 19:41

240302-yefvmagf2110

02/03/2024, 19:39

240302-ydf41age9v10

Analysis

max time kernel
39s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chernobyl.exe
Size 338KB
Sample240302-ydf41age9v
SHA256 30acb23863a1043c7210c8fb75236fce5111bef305c6574e518e9d0e50d740cf
MD5 0f6ef368d9dfdf12dcf44f727fbd4d5c
SHA1 5bbf583c7d0f74255c13b7bbdb5d5609d80393e9
SHA512 16e211d19604b49c4b6837f580ec2c83cb27868f481d3ee33394716110e32ac363165bed5e9445c3807753cac793e5a044c3986d10ab04cfbd832c68438f546c
SSDEEP 6144:Ubeo02222222222222222222222222222222222222222222222222222222222w:QkHOZzv4TatsNqaJA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, cluttscape.exe"	Chernobyl.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Chernobyl.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 14 IoCs

exploit

pid	Process
872	takeown.exe
2656	takeown.exe
2460	takeown.exe
1700	takeown.exe
2960	takeown.exe
1772	icacls.exe
1760	takeown.exe
3064	takeown.exe
3040	takeown.exe
2468	takeown.exe
2920	icacls.exe
2564	takeown.exe
2552	takeown.exe
2512	icacls.exe

Modifies file permissions 1 TTPs 14 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
872	takeown.exe
2656	takeown.exe
2552	takeown.exe
2468	takeown.exe
2512	icacls.exe
2960	takeown.exe
1760	takeown.exe
2920	icacls.exe
1700	takeown.exe
3064	takeown.exe
1772	icacls.exe
2564	takeown.exe
3040	takeown.exe
2460	takeown.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	Chernobyl.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kill.ico	Chernobyl.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\cluttscape.exe	Chernobyl.exe
File created	C:\Windows\cluttscape.exe	Chernobyl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\DefaultIcon\ = "C:\\Windows\\SysWow64\\kill.ico"	Chernobyl.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	Chernobyl.exe
Token: SeDebugPrivilege	2104	Chernobyl.exe
Token: SeTakeOwnershipPrivilege	1760	takeown.exe
Token: SeTakeOwnershipPrivilege	1700	takeown.exe
Token: SeTakeOwnershipPrivilege	872	takeown.exe
Token: SeTakeOwnershipPrivilege	3064	takeown.exe
Token: SeTakeOwnershipPrivilege	2656	takeown.exe
Token: SeTakeOwnershipPrivilege	2564	takeown.exe
Token: SeTakeOwnershipPrivilege	3040	takeown.exe
Token: SeTakeOwnershipPrivilege	2460	takeown.exe
Token: SeTakeOwnershipPrivilege	2552	takeown.exe
Token: SeTakeOwnershipPrivilege	2468	takeown.exe
Token: SeTakeOwnershipPrivilege	2960	takeown.exe
Token: SeShutdownPrivilege	2104	Chernobyl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 320	2104	Chernobyl.exe	29
PID 2104 wrote to memory of 320	2104	Chernobyl.exe	29
PID 2104 wrote to memory of 320	2104	Chernobyl.exe	29
PID 2104 wrote to memory of 320	2104	Chernobyl.exe	29
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 320 wrote to memory of 1456	320	cmd.exe	31
PID 2104 wrote to memory of 1508	2104	Chernobyl.exe	32
PID 2104 wrote to memory of 1508	2104	Chernobyl.exe	32
PID 2104 wrote to memory of 1508	2104	Chernobyl.exe	32
PID 2104 wrote to memory of 1508	2104	Chernobyl.exe	32
PID 1508 wrote to memory of 1760	1508	cmd.exe	34
PID 1508 wrote to memory of 1760	1508	cmd.exe	34
PID 1508 wrote to memory of 1760	1508	cmd.exe	34
PID 1508 wrote to memory of 1760	1508	cmd.exe	34
PID 2104 wrote to memory of 1692	2104	Chernobyl.exe	35
PID 2104 wrote to memory of 1692	2104	Chernobyl.exe	35
PID 2104 wrote to memory of 1692	2104	Chernobyl.exe	35
PID 2104 wrote to memory of 1692	2104	Chernobyl.exe	35
PID 1692 wrote to memory of 1700	1692	cmd.exe	37
PID 1692 wrote to memory of 1700	1692	cmd.exe	37
PID 1692 wrote to memory of 1700	1692	cmd.exe	37
PID 1692 wrote to memory of 1700	1692	cmd.exe	37
PID 2104 wrote to memory of 2252	2104	Chernobyl.exe	38
PID 2104 wrote to memory of 2252	2104	Chernobyl.exe	38
PID 2104 wrote to memory of 2252	2104	Chernobyl.exe	38
PID 2104 wrote to memory of 2252	2104	Chernobyl.exe	38
PID 2252 wrote to memory of 872	2252	cmd.exe	40
PID 2252 wrote to memory of 872	2252	cmd.exe	40
PID 2252 wrote to memory of 872	2252	cmd.exe	40
PID 2252 wrote to memory of 872	2252	cmd.exe	40
PID 2252 wrote to memory of 2920	2252	cmd.exe	41
PID 2252 wrote to memory of 2920	2252	cmd.exe	41
PID 2252 wrote to memory of 2920	2252	cmd.exe	41
PID 2252 wrote to memory of 2920	2252	cmd.exe	41
PID 2104 wrote to memory of 2528	2104	Chernobyl.exe	42
PID 2104 wrote to memory of 2528	2104	Chernobyl.exe	42
PID 2104 wrote to memory of 2528	2104	Chernobyl.exe	42
PID 2104 wrote to memory of 2528	2104	Chernobyl.exe	42
PID 2528 wrote to memory of 3064	2528	cmd.exe	44
PID 2528 wrote to memory of 3064	2528	cmd.exe	44
PID 2528 wrote to memory of 3064	2528	cmd.exe	44
PID 2528 wrote to memory of 3064	2528	cmd.exe	44
PID 2104 wrote to memory of 2544	2104	Chernobyl.exe	45
PID 2104 wrote to memory of 2544	2104	Chernobyl.exe	45
PID 2104 wrote to memory of 2544	2104	Chernobyl.exe	45
PID 2104 wrote to memory of 2544	2104	Chernobyl.exe	45
PID 2544 wrote to memory of 2656	2544	cmd.exe	47
PID 2544 wrote to memory of 2656	2544	cmd.exe	47
PID 2544 wrote to memory of 2656	2544	cmd.exe	47
PID 2544 wrote to memory of 2656	2544	cmd.exe	47
PID 2104 wrote to memory of 2712	2104	Chernobyl.exe	48
PID 2104 wrote to memory of 2712	2104	Chernobyl.exe	48
PID 2104 wrote to memory of 2712	2104	Chernobyl.exe	48
PID 2104 wrote to memory of 2712	2104	Chernobyl.exe	48
PID 2712 wrote to memory of 2564	2712	cmd.exe	50
PID 2712 wrote to memory of 2564	2712	cmd.exe	50
PID 2712 wrote to memory of 2564	2712	cmd.exe	50
PID 2712 wrote to memory of 2564	2712	cmd.exe	50
PID 2104 wrote to memory of 2684	2104	Chernobyl.exe	51

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	Chernobyl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Chernobyl.exe

C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe
"C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\smss.exe && icacls C:\Windows\System32\smss.exe /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\smss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\csrss.exe && icacls C:\Windows\System32\csrss.exe /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\csrss.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\wininit.exe && icacls C:\Windows\System32\wininit.exe /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\wininit.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wininit.exe /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\LogonUI.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\lsass.exe && icacls C:\Windows\System32\lsass.exe /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\lsass.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\services.exe && icacls C:\Windows\System32\services.exe /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\services.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winlogon.exe && icacls C:\Windows\System32\winlogon.exe /grant "%username%:F" && exit
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winlogon.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.efi && icacls C:\Windows\System32\winload.efi /grant "%username%:F" && exit
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.efi
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\winload.exe && icacls C:\Windows\System32\winload.exe /grant "%username%:F" && exit
  2⤵
  PID:2660
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\winload.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\ntoskrnl.exe && icacls C:\Windows\System32\ntoskrnl.exe /grant "%username%:F" && exit
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\ntoskrnl.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\ntoskrnl.exe /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\svchost.exe && icacls C:\Windows\System32\svchost.exe /grant "%username%:F" && exit
  2⤵
  PID:2952
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\svchost.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\svchost.exe /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

—↕óÂ∩ïé☺¤Σ≈Ç—Σ▼■¼ñ¢▼■²█ó╠╔▌ž5£♣☼↕řσ▲¶▼Σ²9®Âπ◘šŸßä≈♫íí╬♫◙▼☼í¾╧♂¾◙¢≈¾å™◙╚╔≈¬¢®ïπ☻♪æ♥πœŸ▌åÇ◘₧—↕≈ž86☺¥éč

Path C:\Users\Admin\Desktop\—↕óÂ∩ïé☺¤Σ≈Ç—Σ▼■¼ñ¢▼■²█ó╠╔▌ž5£♣☼↕řσ▲¶▼Σ²9®Âπ◘šŸßä≈♫íí╬♫◙▼☼í¾╧♂¾◙¢≈¾å™◙╚╔≈¬¢®ïπ☻♪æ♥πœŸ▌åÇ◘₧—↕≈ž86☺¥éč
Size 666B
SHA256 ca687b6a7c3d29b566f3e1988b9f877b51d9a83ee25ffe0755a8dcd3eb5f434a
MD5 9e1e5883c74742a497cf5c272ccd2321
SHA1 2cf33e34d08b8e17743a60352baffef4b6f02dee
SHA512 f2284f0c624cc07a65c16f87865bb98aaa176b1d8b45cd4fbcc1143c9c2297fe6b1d4db55ef054be2bc151c8cc25ff4da7c997b7d38dae3dccd2ffe1c3c01a6b
MD5 SHA1 SHA512

Submit Download

memory/2104-0-0x00000000012C0000-0x000000000131A000-memory.dmp

Download

memory/2104-1-0x0000000073E10000-0x00000000744FE000-memory.dmp

Download

memory/2104-306-0x0000000000A70000-0x0000000000AB0000-memory.dmp

Download

memory/2104-307-0x0000000073E10000-0x00000000744FE000-memory.dmp

Download

memory/2104-308-0x0000000000A70000-0x0000000000AB0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads