Malware

Cronus

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

MITRE ATT&CK Tactic Technique ID Name Initial Access T1566.001 Phishing: Spear phishing Attachment

Execution

3 techniques

T1059.001PowerShellEvidence1

the malware is developed in PowerShell and is executed directly in memory without writing any malicious content to disk

T1059.005Visual BasicEvidence1

Upon extracting the malicious macros from the malicious streams, we found that the malicious VBA was downloading the second stager PowerShell-based loader

T1204.002Malicious FileEvidence1

We initially observed that the initial infection was caused by a malicious Word document, which primarily spread through a Phishing vector.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence The ransomware binary abuses the famous RunKeys for persistence, as it appends a new key named cronus to the above registry hive, which runs the binary RegSvcs.exe on startup.

Privilege Escalation

2 techniques

T1055.012Process HollowingEvidence1

After unpacking the first DLL file, TEStxx.dll, we found that the loaded assembly is responsible for performing process injection. In this case, it injects the second executable, RegSvcs.exe, into a process’s memory.

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence The ransomware binary abuses the famous RunKeys for persistence, as it appends a new key named cronus to the above registry hive, which runs the binary RegSvcs.exe on startup.

Stealth

3 techniques

T1027.010Command ObfuscationEvidence1

the embedded macros work, we found that they are heavily obfuscated with junk comments and variable names... The script is obfuscated using three layers of junk code

T1055.012Process HollowingEvidence1

T1620Reflective Code LoadingEvidence1

the PowerShell payload that executes the ransomware using reflective DLL loading

Discovery

2 techniques

T1057Process DiscoveryEvidence1

The ransomware binary terminates many processes by ending the main window after enumerating all the running processes.

T1083File and Directory DiscoveryEvidence1

The ransomware performs enumeration by initially enumerating the local disk drives, then it enumerates the files present inside the drives.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence1

For files less than 512 KB, the FULL_ENCRYPT method encrypts the files at once. For files bigger than 512 KB, the TRIPLE_ENCRYPT method breaks the file contents into different parts and encrypts them.

T1491.001Internal DefacementEvidence1

Looking into the Main method of this final executable, we can see that the code performs various tasks related to ransomware-based behavior, like changing the wallpaper

T1565.002Transmitted Data ManipulationEvidence1

The ransomware enumerates the Clipboard contents. If it finds any bitcoin address on the clipboard, it replaces it with the threat actor’s BTC wallet’s address

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

uri●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

seqriteNews

Aug 6, 2024

Cronus Ransomware: Fake PayPal Docs & PowerShell | Seqrite

A PowerShell-based fileless ransomware delivered via malicious Word documents themed as fake PayPal receipts. It executes in memory, uses reflective DLL loading and process injection, copies itself for persistence, encrypts files with AES using different routines based on file size, drops a ransom note named cronus.txt, terminates processes, and replaces Bitcoin wallet addresses found in the clipboard.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Cronus

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

MITRE ATT&CK Tactic Technique ID Name Initial Access T1566.001 Phishing: Spear phishing Attachment

Execution

3 techniques

T1059.001PowerShellEvidence1

the malware is developed in PowerShell and is executed directly in memory without writing any malicious content to disk

T1059.005Visual BasicEvidence1

Upon extracting the malicious macros from the malicious streams, we found that the malicious VBA was downloading the second stager PowerShell-based loader

T1204.002Malicious FileEvidence1

We initially observed that the initial infection was caused by a malicious Word document, which primarily spread through a Phishing vector.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence The ransomware binary abuses the famous RunKeys for persistence, as it appends a new key named cronus to the above registry hive, which runs the binary RegSvcs.exe on startup.

Privilege Escalation

2 techniques

T1055.012Process HollowingEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence1

Persistence The ransomware binary abuses the famous RunKeys for persistence, as it appends a new key named cronus to the above registry hive, which runs the binary RegSvcs.exe on startup.

Stealth

3 techniques

T1027.010Command ObfuscationEvidence1

the embedded macros work, we found that they are heavily obfuscated with junk comments and variable names... The script is obfuscated using three layers of junk code

T1055.012Process HollowingEvidence1

T1620Reflective Code LoadingEvidence1

the PowerShell payload that executes the ransomware using reflective DLL loading

Discovery

2 techniques

T1057Process DiscoveryEvidence1

The ransomware binary terminates many processes by ending the main window after enumerating all the running processes.

T1083File and Directory DiscoveryEvidence1

The ransomware performs enumeration by initially enumerating the local disk drives, then it enumerates the files present inside the drives.

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence1

T1491.001Internal DefacementEvidence1

Looking into the Main method of this final executable, we can see that the code performs various tasks related to ransomware-based behavior, like changing the wallpaper

T1565.002Transmitted Data ManipulationEvidence1

The ransomware enumerates the Clipboard contents. If it finds any bitcoin address on the clipboard, it replaces it with the threat actor’s BTC wallet’s address

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

uri●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

seqriteNews

Aug 6, 2024

Cronus Ransomware: Fake PayPal Docs & PowerShell | Seqrite

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.