General
-
Target
Chernobyl.exe
-
Size
424KB
-
Sample
240303-z3l7zshe42
-
MD5
101d28706ba17a0ffabaf6b2ec334df9
-
SHA1
5ac0b8ff7705fe4682bc0504a9add7b7f651cea3
-
SHA256
0b5ebbdb5d04ee14f1c3fb5815bb3afea991d44beb4d33771226d725849ae0eb
-
SHA512
bea84711d4341b08294e9f83d793375afc2b5cd0652bafa5749900506856a45dd21c225c9b009757924b3e47cc00a27237ebbeac1aea2cbe11e1055882209e76
-
SSDEEP
6144:CfJzhWb+fo02222222222222222222222222222222222222222222222222222J:CfJzh0tH01OZzv4TatsNqaJR
Static task
static1
Behavioral task
behavioral1
Sample
Chernobyl.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
Chernobyl.exe
-
Size
424KB
-
MD5
101d28706ba17a0ffabaf6b2ec334df9
-
SHA1
5ac0b8ff7705fe4682bc0504a9add7b7f651cea3
-
SHA256
0b5ebbdb5d04ee14f1c3fb5815bb3afea991d44beb4d33771226d725849ae0eb
-
SHA512
bea84711d4341b08294e9f83d793375afc2b5cd0652bafa5749900506856a45dd21c225c9b009757924b3e47cc00a27237ebbeac1aea2cbe11e1055882209e76
-
SSDEEP
6144:CfJzhWb+fo02222222222222222222222222222222222222222222222222222J:CfJzh0tH01OZzv4TatsNqaJR
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt
-
Modifies file permissions
-
Modifies system executable filetype association
-
Modifies WinLogon
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Event Triggered Execution
1Change Default File Association
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Event Triggered Execution
1Change Default File Association
1