e24fddde2e861d5c361d95ddfc2ea0bb2942fd756e951fee6212052d88bc0fc4

Analysis

max time kernel
148s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

088c4a889ce1a080c6a753e0cea8584e.exe
Size

892KB
MD5

088c4a889ce1a080c6a753e0cea8584e
SHA1

78e47c6a74e49e88b4a4a5bf65474d8a518a38c6
SHA256

e24fddde2e861d5c361d95ddfc2ea0bb2942fd756e951fee6212052d88bc0fc4
SHA512

a7462ccc34851a45ccbf13665e091984a8696341842f9d245c11248464ef5354fa57b4d1d5da29bda46dd0694c0e3e465d38585f12ea6e673f1ce3dafc6ea1ac
SSDEEP

24576:djo2O4KEqkx/BHScxUaI9OCA1w7alc0dWClvjxPbIueP6cU:dgEqO/bsORw7aNdHlbxkx6X

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Coopen²¥·ÅÆ÷.lnk	088c4a889ce1a080c6a753e0cea8584e.exe

Loads dropped DLL 15 IoCs

pid	Process
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 52 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Pause.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\RadioC.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Synopsis1.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\image\Photo\local Photo\B_1.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Cancel.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\image\Wallpaper\local wallpaper\DefaultCoopenWallpaper.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Next.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\CheckU.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\SkinClient.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File opened for modification	C:\Program Files (x86)\Coopen\image\Wallpaper\local wallpaper\ModeAList.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File opened for modification	C:\Program Files (x86)\Coopen\image\Wallpaper\coopen wallpaper\PicList.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\conf\PluginConfig.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Templete\ModeC.tpl	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Background.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Progress.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Confirm.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Play.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\uninst.exe	088c4a889ce1a080c6a753e0cea8584e.exe
File opened for modification	C:\Program Files (x86)\Coopen\conf\All Users.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Templete\ModeB.tpl	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Indicator1.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Indicator2.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\SkinClose.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Templete\DefaultCoopenWallpaper.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Coopen.scr	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Commit.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\RadioU.png	088c4a889ce1a080c6a753e0cea8584e.exe
File opened for modification	C:\Program Files (x86)\Coopen\conf\ModeAChannelListReal.txt	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Channel.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\MainIcon.png	088c4a889ce1a080c6a753e0cea8584e.exe
File opened for modification	C:\Program Files (x86)\Coopen\conf\Admin.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\CheckC.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Config.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\CoopenActiveControl108.dll	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\conf\ModeAChannelList.txt	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\conf\ModeAChannelListReal.txt	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Templete\CoopenPhoto.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Message.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\licence.txt	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Synopsis1.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\image\Photo\local Photo\B_0.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Coopen.exe	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\CoopenAir.exe	088c4a889ce1a080c6a753e0cea8584e.exe
File opened for modification	C:\Program Files (x86)\Coopen\image\Photo\local Photo\ModeBList.ini	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\CoopenMainManager.dll	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Close.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Notify.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Folder.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Prev.png	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\image\Wallpaper\coopen wallpaper\DefaultCoopenWallpaper.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Templete\ModeB_logo.jpg	088c4a889ce1a080c6a753e0cea8584e.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Widget.png	088c4a889ce1a080c6a753e0cea8584e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\Desktop	088c4a889ce1a080c6a753e0cea8584e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Program Files (x86)\\Coopen\\Coopen.scr"	088c4a889ce1a080c6a753e0cea8584e.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe
3960	088c4a889ce1a080c6a753e0cea8584e.exe

C:\Users\Admin\AppData\Local\Temp\088c4a889ce1a080c6a753e0cea8584e.exe
"C:\Users\Admin\AppData\Local\Temp\088c4a889ce1a080c6a753e0cea8584e.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
PID:3960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Coopen\Coopen.exe

Filesize
90KB

MD5
d3e0e36c4de5086d3cac40fefff7832f

SHA1
f8443d6a43f5dec38e549b6edd39b4f1c4cea510

SHA256
1c97d2b71ee0d5f5a8bde7762d0d13021f9a41fd6c84fca1208c97d0ad850b8c

SHA512
d4fbf3664931e0bbf1f23fae1b735162ce35fd3f5f25441be984c6f8204071b0dd72ad9f65cbd70bd1751bdc2bd0d04755e70efd53ae6fa6cfb914e3e083492c

Download Submit
C:\Program Files (x86)\Coopen\conf\Admin.ini

Filesize
275B

MD5
5d06fa6a198a56d4dc56e7f8158e231e

SHA1
971a081d2caeee72af90fbe4d7b6c0637d3ecb25

SHA256
0e107cba101dd8bf65f82d521e2833cee631e4d764b1e65651155ac129c00358

SHA512
f322666863ec8821f6c2102ba30603c15309604362823378d95dfab5686d0524fe15fca3532fda0f02a6978031b151a68bab95f9a05af07da7f9fb4229838bc0

Download Submit
C:\Program Files (x86)\Coopen\conf\All Users.ini

Filesize
128B

MD5
f1c807300762daec403255db9de8e355

SHA1
5bc3892070a29bcdef2655ad95bc155113a07326

SHA256
67dbfb066a8da9a54946019504388eb44de5446ba61afefa72cc6cce532fd160

SHA512
1de2ea22ed7a9bb9b78491f8c23aaa3eba40f5afb361e1790559fadd08f1e340a7f05df6cf5e19f6e9fd793ecc5bf182f6b959956f8c7a00f276a33cdf8a92d8

Download Submit
C:\Program Files (x86)\Coopen\image\Photo\local Photo\ModeBList.ini

Filesize
221B

MD5
be5d6be6c04055fa7bdf6f4bd116ada0

SHA1
3c775702a7c5796bda82ef931c749ed1acc63764

SHA256
38f4b305820feae6925d9fb63545409ff258c265fb68cb2d9431659ce0d6a7a7

SHA512
09f241dbe45dff0ff10bdf383ebb9bf98b6f3ca5e1cd8fcbe902d4051dd8170ee5109dbba4c824de38187219fcd8a0b9e16fcea03f9baa0b60a9e4fd495639d2

Download Submit
C:\Program Files (x86)\Coopen\image\Wallpaper\coopen wallpaper\PicList.ini

Filesize
183B

MD5
b2e4fcaf8fb1aca922b3256ad67cae70

SHA1
d5ac71355f67bc5775accb38b569258d1be3dac5

SHA256
02650ca3221b02dd208301ae918d8408a015d3783e5096a924884d698f598594

SHA512
d93b7b0ad7972dada79b456d8431808cc73d49808730a512a3139011a01f69393298b9c86da68b2c2338bdbc6460e57e12db2ab2c87c0be1b216df34f202f1f3

Download Submit
C:\Program Files (x86)\Coopen\image\Wallpaper\local wallpaper\ModeAList.ini

Filesize
182B

MD5
4973db85d31a71051d885aabffdd5f91

SHA1
08aa158b39486f1ed97047cf1755da40a97dd0f1

SHA256
58a7286d3e4d4f7ab7a710fe399a7e4bf098dbc6d5b0d23b5f8020511cbabfdf

SHA512
e560d87f1561b09b6379da945f1435d2d6eb84b03078da90cbd63bfaeed8947d6d052329159b88bfe765910ba34ba6a74344543ec33e0fc4ee96fa44da90884f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmB1BE.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmB1BE.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/3960-75-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-114-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-113-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-13-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-112-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-60-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-59-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download
memory/3960-125-0x00000000022F0000-0x00000000022F3000-memory.dmp

Filesize
12KB

Download