e24fddde2e861d5c361d95ddfc2ea0bb2942fd756e951fee6212052d88bc0fc4

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

088c4a889ce1a080c6a753e0cea8584e.exe
Size

892KB
MD5

088c4a889ce1a080c6a753e0cea8584e
SHA1

78e47c6a74e49e88b4a4a5bf65474d8a518a38c6
SHA256

e24fddde2e861d5c361d95ddfc2ea0bb2942fd756e951fee6212052d88bc0fc4
SHA512

a7462ccc34851a45ccbf13665e091984a8696341842f9d245c11248464ef5354fa57b4d1d5da29bda46dd0694c0e3e465d38585f12ea6e673f1ce3dafc6ea1ac
SSDEEP

24576:djo2O4KEqkx/BHScxUaI9OCA1w7alc0dWClvjxPbIueP6cU:dgEqO/bsORw7aNdHlbxkx6X

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Coopen²¥·ÅÆ÷.lnk	088c4a889ce1a080c6a753e0cea8584e.exe

Loads dropped DLL 8 IoCs

pid	Process
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Coopen\Coopen.exe	088c4a889ce1a080c6a753e0cea8584e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop	088c4a889ce1a080c6a753e0cea8584e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Users\\Public\\Coopen\\Coopen.scr"	088c4a889ce1a080c6a753e0cea8584e.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe
2340	088c4a889ce1a080c6a753e0cea8584e.exe

C:\Users\Admin\AppData\Local\Temp\088c4a889ce1a080c6a753e0cea8584e.exe
"C:\Users\Admin\AppData\Local\Temp\088c4a889ce1a080c6a753e0cea8584e.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Coopen\Coopen.exe

Filesize
90KB

MD5
d3e0e36c4de5086d3cac40fefff7832f

SHA1
f8443d6a43f5dec38e549b6edd39b4f1c4cea510

SHA256
1c97d2b71ee0d5f5a8bde7762d0d13021f9a41fd6c84fca1208c97d0ad850b8c

SHA512
d4fbf3664931e0bbf1f23fae1b735162ce35fd3f5f25441be984c6f8204071b0dd72ad9f65cbd70bd1751bdc2bd0d04755e70efd53ae6fa6cfb914e3e083492c

Download Submit
C:\Users\Public\Coopen\image\Photo\local Photo\ModeBList.ini

Filesize
207B

MD5
16ae315b66e839d1c401c96d7900131b

SHA1
00f174199d70f1365c9d44a4d1548519c249ce5b

SHA256
94964743d23c319b9c44f923fccca3df8d8f8f0dd9a5ef8ec2940c383c9d4668

SHA512
614ed03c15897d9ad9efcd6a41f1be1e86f130f48cdaa3a211fac0b00e949c4adc3539737c71f83fc208057ffd2e50a7c2b39d5679031f32a3a0e8a83eb61e46

Download Submit
\Users\Admin\AppData\Local\Temp\nso17A8.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nso17A8.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/2340-41-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/2340-45-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/2340-38-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/2340-35-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download
memory/2340-123-0x00000000002F0000-0x00000000002F3000-memory.dmp

Filesize
12KB

Download
memory/2340-140-0x00000000002D0000-0x00000000002D3000-memory.dmp

Filesize
12KB

Download