Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 00:21
Static task
static1
Behavioral task
behavioral1
Sample
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe
Resource
win10v2004-20220901-en
General
-
Target
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe
-
Size
120KB
-
MD5
006d3038c135e04efc24749d1f9e4e0f
-
SHA1
955b12400cf6dfbe15b07f058aaecdabfea0509e
-
SHA256
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76
-
SHA512
e4499be96ecee0422fc76caee9ab62cf610b0b3f9c0df26e8785a02d457925ba1106d5550dadd48629bc134ec5cb07fa3d279f96ffd0748ae1e8656a27b2bc89
-
SSDEEP
3072:xGyqafpd1/l0izZF6yCenK2iGlefx8X1y:xGw1pzZF44K3AAKX1
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.execooaca.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cooaca.exe -
Executes dropped EXE 1 IoCs
Processes:
cooaca.exepid process 908 cooaca.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe -
Adds Run key to start application 2 TTPs 54 IoCs
Processes:
cooaca.exe74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /P" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /X" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /v" cooaca.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /g" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /e" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /j" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /I" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /d" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /K" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /u" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /a" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /p" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /R" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /y" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /i" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /h" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /D" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /C" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /T" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /A" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /F" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /H" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /n" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /s" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /Z" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /t" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /Q" 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /B" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /U" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /o" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /W" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /w" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /J" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /z" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /Y" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /G" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /S" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /b" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /k" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /q" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /N" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /l" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /r" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /c" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /E" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /x" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /L" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /O" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /V" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /M" cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /f" cooaca.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ cooaca.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cooaca = "C:\\Users\\Admin\\cooaca.exe /m" cooaca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.execooaca.exepid process 4460 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe 4460 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe 908 cooaca.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.execooaca.exepid process 4460 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe 908 cooaca.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exedescription pid process target process PID 4460 wrote to memory of 908 4460 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe cooaca.exe PID 4460 wrote to memory of 908 4460 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe cooaca.exe PID 4460 wrote to memory of 908 4460 74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe cooaca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe"C:\Users\Admin\AppData\Local\Temp\74fcc04493fb7ad4df3e967265b0bd4fcaa10a8f2f8f3b9dce106487003f7d76.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\cooaca.exe"C:\Users\Admin\cooaca.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD526bdc53943848e80d89476347f914c1e
SHA1588d7601b629554fc42a3d2bc3a8c58e9714ce7c
SHA2564b8bf8af54d26ad0ee0caae68fd8173903c268bbd069877441c32a7c2506cedc
SHA512bab96e4cf5cb8c8e0775614068fabfaf192e0cfc359e8ca8281e69de7973bb449e303e41718dca5a4d79c0e612a012d57fe9e6ea24ac15857e674a5ac3a866d7
-
Filesize
120KB
MD526bdc53943848e80d89476347f914c1e
SHA1588d7601b629554fc42a3d2bc3a8c58e9714ce7c
SHA2564b8bf8af54d26ad0ee0caae68fd8173903c268bbd069877441c32a7c2506cedc
SHA512bab96e4cf5cb8c8e0775614068fabfaf192e0cfc359e8ca8281e69de7973bb449e303e41718dca5a4d79c0e612a012d57fe9e6ea24ac15857e674a5ac3a866d7