Analysis
- max time kernel
67s - max time network
71s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
02/03/2024, 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Chernobyl.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
General
- Target Chernobyl.exe
- Size 338KB
- Sample240302-yefvmagf21
- SHA256 30acb23863a1043c7210c8fb75236fce5111bef305c6574e518e9d0e50d740cf
- MD5 0f6ef368d9dfdf12dcf44f727fbd4d5c
- SHA1 5bbf583c7d0f74255c13b7bbdb5d5609d80393e9
- SHA512 16e211d19604b49c4b6837f580ec2c83cb27868f481d3ee33394716110e32ac363165bed5e9445c3807753cac793e5a044c3986d10ab04cfbd832c68438f546c
- SSDEEP 6144:Ubeo02222222222222222222222222222222222222222222222222222222222w:QkHOZzv4TatsNqaJA
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, cluttscape.exe" Chernobyl.exe - Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 1100 created 1916 1100 taskmgr.exe 86 PID 1100 created 1916 1100 taskmgr.exe 86 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Chernobyl.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Chernobyl.exe - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation Chernobyl.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 4048 takeown.exe 4056 takeown.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Chernobyl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Chernobyl.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0" Chernobyl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1" Chernobyl.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\kill.ico Chernobyl.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\cluttscape.exe Chernobyl.exe File opened for modification C:\Windows\cluttscape.exe Chernobyl.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unknown\DefaultIcon\ = "C:\\Windows\\SysWow64\\kill.ico" Chernobyl.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1100 taskmgr.exe Token: SeSystemProfilePrivilege 1100 taskmgr.exe Token: SeCreateGlobalPrivilege 1100 taskmgr.exe Token: SeDebugPrivilege 1916 Chernobyl.exe Token: SeDebugPrivilege 1916 Chernobyl.exe Token: SeTakeOwnershipPrivilege 4048 takeown.exe Token: SeTakeOwnershipPrivilege 4056 takeown.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe 1100 taskmgr.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1916 wrote to memory of 2616 1916 Chernobyl.exe 100 PID 1916 wrote to memory of 2616 1916 Chernobyl.exe 100 PID 1916 wrote to memory of 2616 1916 Chernobyl.exe 100 PID 2616 wrote to memory of 1824 2616 cmd.exe 102 PID 2616 wrote to memory of 1824 2616 cmd.exe 102 PID 2616 wrote to memory of 1824 2616 cmd.exe 102 PID 1916 wrote to memory of 4460 1916 Chernobyl.exe 104 PID 1916 wrote to memory of 4460 1916 Chernobyl.exe 104 PID 1916 wrote to memory of 4460 1916 Chernobyl.exe 104 PID 4460 wrote to memory of 4048 4460 cmd.exe 106 PID 4460 wrote to memory of 4048 4460 cmd.exe 106 PID 4460 wrote to memory of 4048 4460 cmd.exe 106 PID 1916 wrote to memory of 3584 1916 Chernobyl.exe 107 PID 1916 wrote to memory of 3584 1916 Chernobyl.exe 107 PID 1916 wrote to memory of 3584 1916 Chernobyl.exe 107 PID 3584 wrote to memory of 4056 3584 cmd.exe 109 PID 3584 wrote to memory of 4056 3584 cmd.exe 109 PID 3584 wrote to memory of 4056 3584 cmd.exe 109 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" Chernobyl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1" Chernobyl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Chernobyl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe"C:\Users\Admin\AppData\Local\Temp\Chernobyl.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k start RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵PID:1824
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\smss.exe && icacls C:\Windows\System32\smss.exe /grant "%username%:F" && exit2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\System32\smss.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4048
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\csrss.exe && icacls C:\Windows\System32\csrss.exe /grant "%username%:F" && exit2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\System32\csrss.exe3⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4056
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1100
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\a352b635670c40d6b22e9ad404b1dbfb /t 4232 /p 19161⤵PID:992
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
φ¢∩åšïõ█◙♥ŸΣ¢£♠«☺►╠♥◄Ǿř4╤왬½é♂®õ≈◙₧■πß╧¤1φ◙■π╬π☻44≈ǵč►å▼∞≈×♣╤▄9☺▐Ç♣█Â☻¥å╥▲Â▼♪3≈♫Ÿ↕õ↕♀▀Æ≈¶▼◙æ¤2♫◄±
- Path C:\Users\Admin\Desktop\φ¢∩åšïõ█◙♥ŸΣ¢£♠«☺►╠♥◄Ǿř4╤왬½é♂®õ≈◙₧■πß╧¤1φ◙■π╬π☻44≈ǵč►å▼∞≈×♣╤▄9☺▐Ç♣█Â☻¥å╥▲Â▼♪3≈♫Ÿ↕õ↕♀▀Æ≈¶▼◙æ¤2♫◄±
- Size 666B
- SHA256 ca687b6a7c3d29b566f3e1988b9f877b51d9a83ee25ffe0755a8dcd3eb5f434a
- MD5 9e1e5883c74742a497cf5c272ccd2321
- SHA1 2cf33e34d08b8e17743a60352baffef4b6f02dee
- SHA512 f2284f0c624cc07a65c16f87865bb98aaa176b1d8b45cd4fbcc1143c9c2297fe6b1d4db55ef054be2bc151c8cc25ff4da7c997b7d38dae3dccd2ffe1c3c01a6b
- MD5 SHA1 SHA512