e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803

Analysis

max time kernel
97s
max time network
132s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
Size

54KB
MD5

2a3fb18c680d1db507969f93ad76b726
SHA1

9a60bb7131f93e94274ffbfb722f4b53b906d6b1
SHA256

e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803
SHA512

d59c90e640e45e326096581b935a018f2f007607ac1c27471c723c39cbf7c314e11442c7cba34bf3635dcb6c8a8d8d6a76e5b5a68c5670e5104b1960f38bf344
SSDEEP

768:6rpGUKbGPJfS/A+0jmlZ8veI+2qYg7ZffFLCNnbcuyD7U7R:6Hq/ADjmlZ8GITMdL2nouy87R

Score

8^/10

evasion persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1692	coiome.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
560	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\safe360 = "C:\\Program Files\\Common Files\\sfbsbvx\\coiome.exe"	mshta.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\sfbsbvx	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
File created	C:\Program Files (x86)\DGT.hta	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
File created	C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
File opened for modification	C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
File opened for modification	C:\Program Files (x86)\Common Files\sfbsbvx	coiome.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2008	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
1072	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\default_page_url = "http://www.52cailing.com"	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Search Page = "http://www.52cailing.com"	mshta.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.52cailing.com"	mshta.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
Token: SeDebugPrivilege	1072	taskkill.exe
Token: SeDebugPrivilege	1692	coiome.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 1656	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	28
PID 868 wrote to memory of 1656	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	28
PID 868 wrote to memory of 1656	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	28
PID 868 wrote to memory of 1656	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	28
PID 868 wrote to memory of 1420	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	30
PID 868 wrote to memory of 1420	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	30
PID 868 wrote to memory of 1420	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	30
PID 868 wrote to memory of 1420	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	30
PID 1420 wrote to memory of 1072	1420	cmd.exe	32
PID 1420 wrote to memory of 1072	1420	cmd.exe	32
PID 1420 wrote to memory of 1072	1420	cmd.exe	32
PID 1420 wrote to memory of 1072	1420	cmd.exe	32
PID 868 wrote to memory of 1692	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	34
PID 868 wrote to memory of 1692	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	34
PID 868 wrote to memory of 1692	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	34
PID 868 wrote to memory of 1692	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	34
PID 868 wrote to memory of 560	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	35
PID 868 wrote to memory of 560	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	35
PID 868 wrote to memory of 560	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	35
PID 868 wrote to memory of 560	868	e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe	35
PID 1692 wrote to memory of 860	1692	coiome.exe	38
PID 1692 wrote to memory of 860	1692	coiome.exe	38
PID 1692 wrote to memory of 860	1692	coiome.exe	38
PID 1692 wrote to memory of 860	1692	coiome.exe	38
PID 860 wrote to memory of 2008	860	cmd.exe	40
PID 860 wrote to memory of 2008	860	cmd.exe	40
PID 860 wrote to memory of 2008	860	cmd.exe	40
PID 860 wrote to memory of 2008	860	cmd.exe	40
PID 1692 wrote to memory of 1936	1692	coiome.exe	41
PID 1692 wrote to memory of 1936	1692	coiome.exe	41
PID 1692 wrote to memory of 1936	1692	coiome.exe	41
PID 1692 wrote to memory of 1936	1692	coiome.exe	41
PID 1692 wrote to memory of 1116	1692	coiome.exe	43
PID 1692 wrote to memory of 1116	1692	coiome.exe	43
PID 1692 wrote to memory of 1116	1692	coiome.exe	43
PID 1692 wrote to memory of 1116	1692	coiome.exe	43
PID 1116 wrote to memory of 1804	1116	cmd.exe	46
PID 1116 wrote to memory of 1804	1116	cmd.exe	46
PID 1116 wrote to memory of 1804	1116	cmd.exe	46
PID 1116 wrote to memory of 1804	1116	cmd.exe	46
PID 1936 wrote to memory of 1076	1936	cmd.exe	45
PID 1936 wrote to memory of 1076	1936	cmd.exe	45
PID 1936 wrote to memory of 1076	1936	cmd.exe	45
PID 1936 wrote to memory of 1076	1936	cmd.exe	45
PID 1692 wrote to memory of 1228	1692	coiome.exe	47
PID 1692 wrote to memory of 1228	1692	coiome.exe	47
PID 1692 wrote to memory of 1228	1692	coiome.exe	47
PID 1692 wrote to memory of 1228	1692	coiome.exe	47
PID 1692 wrote to memory of 1032	1692	coiome.exe	49
PID 1692 wrote to memory of 1032	1692	coiome.exe	49
PID 1692 wrote to memory of 1032	1692	coiome.exe	49
PID 1692 wrote to memory of 1032	1692	coiome.exe	49
PID 1692 wrote to memory of 1972	1692	coiome.exe	51
PID 1692 wrote to memory of 1972	1692	coiome.exe	51
PID 1692 wrote to memory of 1972	1692	coiome.exe	51
PID 1692 wrote to memory of 1972	1692	coiome.exe	51

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1076	attrib.exe
1804	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
"C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DGT.hta"
  2⤵
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im coiome.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im coiome.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe
  "C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c sc delete JavaServe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Windows\SysWOW64\sc.exe
      sc delete JavaServe
      4⤵
      Launches sc.exe
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"
      4⤵
      Views/modifies file attributes
      PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"
      4⤵
      Views/modifies file attributes
      PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Cookies\*.*
    3⤵
    PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"
    3⤵
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"
  2⤵
  - Deletes itself
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe

Filesize
12.1MB

MD5
c17abe22a67cde15e056ff1e6b4e548e

SHA1
f56bb568c36003722c5d1955efb6c0ef38db758a

SHA256
b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b

SHA512
3e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9

Download Submit
C:\Program Files (x86)\DGT.hta

Filesize
780B

MD5
cfae0efb683986503bb789616bad8b55

SHA1
9325f503e9c4d97a7d06d81859f73d245a974753

SHA256
8f1076023a3e05a05e9938b08398e885a516f7442a19cd0de7fd3a87f6c0ccd8

SHA512
e338c41006f670cc98554f1c3a262cc7e4d9dd680bd9d77cc2b5a048a7f3b630f59df6a02fe6542df71647ce3eb7541f86bc3266fad396a9859620a7d26a942c

Download Submit
\Program Files (x86)\Common Files\sfbsbvx\coiome.exe

Filesize
12.1MB

MD5
c17abe22a67cde15e056ff1e6b4e548e

SHA1
f56bb568c36003722c5d1955efb6c0ef38db758a

SHA256
b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b

SHA512
3e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9

Download Submit
\Program Files (x86)\Common Files\sfbsbvx\coiome.exe

Filesize
12.1MB

MD5
c17abe22a67cde15e056ff1e6b4e548e

SHA1
f56bb568c36003722c5d1955efb6c0ef38db758a

SHA256
b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b

SHA512
3e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9

Download Submit
memory/868-67-0x00000000002D0000-0x00000000002DF000-memory.dmp

Filesize
60KB

Download
memory/868-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/868-61-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/868-68-0x00000000002D0000-0x00000000002DF000-memory.dmp

Filesize
60KB

Download
memory/868-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

Filesize
8KB

Download
memory/1692-71-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1692-69-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads