9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb

Analysis

max time kernel
100s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
Size

62KB
MD5

34d7a477d69b4c406c6539df7cd8f0d6
SHA1

7bef53fec89190c3a0c9c19d0ca564235819e672
SHA256

9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb
SHA512

0709ca199c97d08179336f18466b2170d211f0ef4137fab93cf2b284e72a897e4b72285f4e8c2f6fddfea7488811999cfa98b5f15a2119f2453995708bd5b5aa
SSDEEP

768:krpeUKbGP2fSR1A+p2mbZ8veITg+zyRv077IaXriKBTnbcuyD7UQH:kMqR1AG2mbZ8GITDzy1a7iKBTnouy8QH

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2040	coiome.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\safe360 = "C:\\Program Files\\Common Files\\sebsbvx\\coiome.exe"	mshta.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\sebsbvx	coiome.exe
File opened for modification	C:\Program Files (x86)\Common Files\sebsbvx	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File created	C:\Program Files (x86)\ABI.hta	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File created	C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
File opened for modification	C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1904	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
308	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com"	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com"	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	2040	coiome.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4892	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	82
PID 5032 wrote to memory of 4892	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	82
PID 5032 wrote to memory of 4892	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	82
PID 5032 wrote to memory of 1812	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	86
PID 5032 wrote to memory of 1812	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	86
PID 5032 wrote to memory of 1812	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	86
PID 1812 wrote to memory of 308	1812	cmd.exe	88
PID 1812 wrote to memory of 308	1812	cmd.exe	88
PID 1812 wrote to memory of 308	1812	cmd.exe	88
PID 5032 wrote to memory of 2040	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	89
PID 5032 wrote to memory of 2040	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	89
PID 5032 wrote to memory of 2040	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	89
PID 5032 wrote to memory of 1384	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	90
PID 5032 wrote to memory of 1384	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	90
PID 5032 wrote to memory of 1384	5032	9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe	90
PID 2040 wrote to memory of 4208	2040	coiome.exe	92
PID 2040 wrote to memory of 4208	2040	coiome.exe	92
PID 2040 wrote to memory of 4208	2040	coiome.exe	92
PID 4208 wrote to memory of 1904	4208	cmd.exe	94
PID 4208 wrote to memory of 1904	4208	cmd.exe	94
PID 4208 wrote to memory of 1904	4208	cmd.exe	94
PID 2040 wrote to memory of 2624	2040	coiome.exe	95
PID 2040 wrote to memory of 2624	2040	coiome.exe	95
PID 2040 wrote to memory of 2624	2040	coiome.exe	95
PID 2624 wrote to memory of 4652	2624	cmd.exe	97
PID 2624 wrote to memory of 4652	2624	cmd.exe	97
PID 2624 wrote to memory of 4652	2624	cmd.exe	97
PID 2040 wrote to memory of 756	2040	coiome.exe	98
PID 2040 wrote to memory of 756	2040	coiome.exe	98
PID 2040 wrote to memory of 756	2040	coiome.exe	98
PID 756 wrote to memory of 4540	756	cmd.exe	100
PID 756 wrote to memory of 4540	756	cmd.exe	100
PID 756 wrote to memory of 4540	756	cmd.exe	100
PID 2040 wrote to memory of 2780	2040	coiome.exe	101
PID 2040 wrote to memory of 2780	2040	coiome.exe	101
PID 2040 wrote to memory of 2780	2040	coiome.exe	101
PID 2040 wrote to memory of 420	2040	coiome.exe	103
PID 2040 wrote to memory of 420	2040	coiome.exe	103
PID 2040 wrote to memory of 420	2040	coiome.exe	103
PID 2040 wrote to memory of 4448	2040	coiome.exe	105
PID 2040 wrote to memory of 4448	2040	coiome.exe	105
PID 2040 wrote to memory of 4448	2040	coiome.exe	105

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4652	attrib.exe
4540	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe
"C:\Users\Admin\AppData\Local\Temp\9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\ABI.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im coiome.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im coiome.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:308
- C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe
  "C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c sc delete JavaServe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\SysWOW64\sc.exe
      sc delete JavaServe
      4⤵
      Launches sc.exe
      PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"
      4⤵
      Views/modifies file attributes
      PID:4652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"
      4⤵
      Views/modifies file attributes
      PID:4540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Cookies\*.*
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
    3⤵
    PID:420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\9d313d35bff618c041633e02019d6bf9c079868b450ee99e1b74c6cde238c2eb.exe"
  2⤵
  PID:1384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ABI.hta

Filesize
780B

MD5
123760c0b2b15cca0448e52b2b7f9f48

SHA1
e0d1004b3878b6c420b1c01f4953089c92921b20

SHA256
4244569e7c8cd1d29b0e6a467b73b397c75cdbf607de60e101da0963a363a615

SHA512
9aeb90f1cbf901da10bf75cc64177c1ecbd23fdfc9884caee442409bf34ebd6605c3dc6269b68490b7151554cb580a5e64c33a4ecdf42a5b146741fef022b9d1

Download Submit
C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe

Filesize
12.1MB

MD5
8db679b5e63052f1eafa66e3c7dbc5f0

SHA1
4cd5c349468b9bff352895708ba1fcdb56a48081

SHA256
78828cf6a08bcaffb7857db51552b3e0eb4d918c8fed7e1a17f9f2b76055f86a

SHA512
c43511f02419240248b9b38bc83cf8f98f9d361850555adcb58b84e8d7a26c50b7f84a5d3f5825ae706ccc7e054a24ec94f525e833ce7301fa737f81fff94dbd

Download Submit
C:\Program Files (x86)\Common Files\sebsbvx\coiome.exe

Filesize
12.1MB

MD5
8db679b5e63052f1eafa66e3c7dbc5f0

SHA1
4cd5c349468b9bff352895708ba1fcdb56a48081

SHA256
78828cf6a08bcaffb7857db51552b3e0eb4d918c8fed7e1a17f9f2b76055f86a

SHA512
c43511f02419240248b9b38bc83cf8f98f9d361850555adcb58b84e8d7a26c50b7f84a5d3f5825ae706ccc7e054a24ec94f525e833ce7301fa737f81fff94dbd

Download Submit
memory/2040-141-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2040-143-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/5032-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/5032-135-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads