9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb

Analysis

max time kernel
63s
max time network
67s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
Size

62KB
MD5

34d7a477d69b4c406c6539df7cd8f0d6
SHA1

7bef53fec89190c3a0c9c19d0ca564235819e672
SHA256

9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb
SHA512

0709ca199c97d08179336f18466b2170d211f0ef4137fab93cf2b284e72a897e4b72285f4e8c2f6fddfea7488811999cfa98b5f15a2119f2453995708bd5b5aa
SSDEEP

768:krpeUKbGP2fSR1A+p2mbZ8veITg+zyRv077IaXriKBTnbcuyD7UQH:kMqR1AG2mbZ8GITDzy1a7iKBTnouy8QH

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1048	coiome.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
1640	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\safe360 = "C:\\Program Files\\Common Files\\sebsbvx\\coiome.exe"	mshta.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	mshta.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\sebsbvx	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File created	C:\Program Files (x86)\JCN.hta	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File created	C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File opened for modification	C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File opened for modification	C:\Program Files (x86)\Common Files\sebsbvx	coiome.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1160	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
648	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com"	mshta.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com"	mshta.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
Token: SeDebugPrivilege	648	taskkill.exe
Token: SeDebugPrivilege	1048	coiome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2004	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	27
PID 1448 wrote to memory of 2004	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	27
PID 1448 wrote to memory of 2004	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	27
PID 1448 wrote to memory of 2004	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	27
PID 1448 wrote to memory of 584	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	29
PID 1448 wrote to memory of 584	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	29
PID 1448 wrote to memory of 584	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	29
PID 1448 wrote to memory of 584	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	29
PID 584 wrote to memory of 648	584	cmd.exe	31
PID 584 wrote to memory of 648	584	cmd.exe	31
PID 584 wrote to memory of 648	584	cmd.exe	31
PID 584 wrote to memory of 648	584	cmd.exe	31
PID 1448 wrote to memory of 1048	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	33
PID 1448 wrote to memory of 1048	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	33
PID 1448 wrote to memory of 1048	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	33
PID 1448 wrote to memory of 1048	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	33
PID 1448 wrote to memory of 1640	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	34
PID 1448 wrote to memory of 1640	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	34
PID 1448 wrote to memory of 1640	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	34
PID 1448 wrote to memory of 1640	1448	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	34
PID 1048 wrote to memory of 1076	1048	coiome.exe	37
PID 1048 wrote to memory of 1076	1048	coiome.exe	37
PID 1048 wrote to memory of 1076	1048	coiome.exe	37
PID 1048 wrote to memory of 1076	1048	coiome.exe	37
PID 1076 wrote to memory of 1160	1076	cmd.exe	39
PID 1076 wrote to memory of 1160	1076	cmd.exe	39
PID 1076 wrote to memory of 1160	1076	cmd.exe	39
PID 1076 wrote to memory of 1160	1076	cmd.exe	39
PID 1048 wrote to memory of 1020	1048	coiome.exe	40
PID 1048 wrote to memory of 1020	1048	coiome.exe	40
PID 1048 wrote to memory of 1020	1048	coiome.exe	40
PID 1048 wrote to memory of 1020	1048	coiome.exe	40
PID 1048 wrote to memory of 1744	1048	coiome.exe	43
PID 1048 wrote to memory of 1744	1048	coiome.exe	43
PID 1048 wrote to memory of 1744	1048	coiome.exe	43
PID 1048 wrote to memory of 1744	1048	coiome.exe	43
PID 1020 wrote to memory of 1876	1020	cmd.exe	42
PID 1020 wrote to memory of 1876	1020	cmd.exe	42
PID 1020 wrote to memory of 1876	1020	cmd.exe	42
PID 1020 wrote to memory of 1876	1020	cmd.exe	42
PID 1744 wrote to memory of 992	1744	cmd.exe	45
PID 1744 wrote to memory of 992	1744	cmd.exe	45
PID 1744 wrote to memory of 992	1744	cmd.exe	45
PID 1744 wrote to memory of 992	1744	cmd.exe	45
PID 1048 wrote to memory of 1484	1048	coiome.exe	46
PID 1048 wrote to memory of 1484	1048	coiome.exe	46
PID 1048 wrote to memory of 1484	1048	coiome.exe	46
PID 1048 wrote to memory of 1484	1048	coiome.exe	46
PID 1048 wrote to memory of 1972	1048	coiome.exe	48
PID 1048 wrote to memory of 1972	1048	coiome.exe	48
PID 1048 wrote to memory of 1972	1048	coiome.exe	48
PID 1048 wrote to memory of 1972	1048	coiome.exe	48
PID 1048 wrote to memory of 1588	1048	coiome.exe	50
PID 1048 wrote to memory of 1588	1048	coiome.exe	50
PID 1048 wrote to memory of 1588	1048	coiome.exe	50
PID 1048 wrote to memory of 1588	1048	coiome.exe	50

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1876	attrib.exe
992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
"C:\Users\Admin\AppData\Local\Temp\9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\JCN.hta"
  2⤵
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im coiome.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im coiome.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:648
- C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe
  "C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c sc delete JavaServe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\SysWOW64\sc.exe
      sc delete JavaServe
      4⤵
      Launches sc.exe
      PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"
      4⤵
      Views/modifies file attributes
      PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"
      4⤵
      Views/modifies file attributes
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Cookies\*.*
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe"
  2⤵
  - Deletes itself
  PID:1640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe

Filesize
12.1MB

MD5
f4042f294b91c5b4ce952bf8fc6733c9

SHA1
77ab09764b7b0a7bd4107f6c5467a36f55ccc79c

SHA256
5fe455b1a3b04a592d1c6b93daa5091f071582b0f5b30164f3205201da5b0c9a

SHA512
6475cfbe1752ad3dbcaa0f9b288e62ce2f3a2a436db18aa8a59d432b5712376a95653e97f3b174432cc752285ba0f7faef9742bf2df707c000579a2ec39e211d

Download Submit
C:\Program Files (x86)\JCN.hta

Filesize
780B

MD5
123760c0b2b15cca0448e52b2b7f9f48

SHA1
e0d1004b3878b6c420b1c01f4953089c92921b20

SHA256
4244569e7c8cd1d29b0e6a467b73b397c75cdbf607de60e101da0963a363a615

SHA512
9aeb90f1cbf901da10bf75cc64177c1ecbd23fdfc9884caee442409bf34ebd6605c3dc6269b68490b7151554cb580a5e64c33a4ecdf42a5b146741fef022b9d1

Download Submit
\Program Files (x86)\Common Files\sebsbvx\coiome.exe

Filesize
12.1MB

MD5
f4042f294b91c5b4ce952bf8fc6733c9

SHA1
77ab09764b7b0a7bd4107f6c5467a36f55ccc79c

SHA256
5fe455b1a3b04a592d1c6b93daa5091f071582b0f5b30164f3205201da5b0c9a

SHA512
6475cfbe1752ad3dbcaa0f9b288e62ce2f3a2a436db18aa8a59d432b5712376a95653e97f3b174432cc752285ba0f7faef9742bf2df707c000579a2ec39e211d

Download Submit
\Program Files (x86)\Common Files\sebsbvx\coiome.exe

Filesize
12.1MB

MD5
f4042f294b91c5b4ce952bf8fc6733c9

SHA1
77ab09764b7b0a7bd4107f6c5467a36f55ccc79c

SHA256
5fe455b1a3b04a592d1c6b93daa5091f071582b0f5b30164f3205201da5b0c9a

SHA512
6475cfbe1752ad3dbcaa0f9b288e62ce2f3a2a436db18aa8a59d432b5712376a95653e97f3b174432cc752285ba0f7faef9742bf2df707c000579a2ec39e211d

Download Submit
memory/1048-68-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1448-65-0x00000000002A0000-0x00000000002B1000-memory.dmp

Filesize
68KB

Download
memory/1448-56-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1448-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1448-64-0x00000000002A0000-0x00000000002B1000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads