description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CocCocUpdate.exe	CocCocUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CocCocUpdate.exe\DisableExceptionChainValidation = "0"	CocCocUpdate.exe

pid	Process
2672	CocCocUpdate.exe
2264	CocCocUpdate.exe
1164	CocCocUpdate.exe
228	CocCocUpdateComRegisterShell64.exe
4884	CocCocUpdateComRegisterShell64.exe
3144	CocCocUpdateComRegisterShell64.exe
1748	CocCocUpdate.exe
3384	CocCocUpdate.exe
2312	CocCocUpdate.exe
2304	CocCocUpdate.exe
556	CocCocUpdate.exe
4652	CocCocUpdateComRegisterShell64.exe
3612	CocCocUpdateComRegisterShell64.exe
3948	CocCocUpdateComRegisterShell64.exe
2520	CocCocUpdate.exe

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32	CocCocUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32	CocCocUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32\ThreadingModel = "Both"	CocCocUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2560148E-7680-4457-999A-188115E23484}\InprocServer32\ = "C:\\Program Files (x86)\\CocCoc\\Update\\2.9.1.11\\psmachine_64.dll"	CocCocUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBFA21E1-BBB8-46B3-95EB-791E29BA42F3}\InprocServer32	CocCocUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3124620-6D96-42F8-BA39-EEE8E5F387A9}\InProcServer32	CocCocUpdateComRegisterShell64.exe

description	ioc	Process
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\psmachine_64.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdateSetup.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdateComRegisterShell64.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdateComRegisterShell64.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\coccocpdateres_en.dll	CocCocSetup.exe
File opened for modification	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdateSetup.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdateOnDemand.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\psmachine.dll	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocCrashHandler64.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\coccocpdateres_vi.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdateOnDemand.exe	CocCocUpdate.exe
File opened for modification	C:\Program Files (x86)\CocCoc\Temp\GUTBAB6.tmp	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdateSetup.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\psuser.dll	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\coccocpdateres_vi.dll	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdateCore.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocCrashHandler.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\coccocpdate.dll	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\psmachine_64.dll	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\coccocpdate.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\coccocpdateres_en.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\psuser_64.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdateBroker.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdate.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\psmachine.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdateBroker.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdate.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocCrashHandler.exe	CocCocSetup.exe
File opened for modification	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\CocCocUpdate.exe	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Update\2.9.1.11\psuser.dll	CocCocUpdate.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocCrashHandler64.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\psuser_64.dll	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Temp\GUMBAA5.tmp\CocCocUpdateCore.exe	CocCocSetup.exe
File created	C:\Program Files (x86)\CocCoc\Update\CocCocUpdate.exe	CocCocUpdate.exe

description	pid	Process
Token: SeDebugPrivilege	2672	CocCocUpdate.exe
Token: SeDebugPrivilege	2672	CocCocUpdate.exe
Token: SeDebugPrivilege	2672	CocCocUpdate.exe
Token: SeDebugPrivilege	2672	CocCocUpdate.exe
Token: SeDebugPrivilege	2672	CocCocUpdate.exe
Token: SeDebugPrivilege	2672	CocCocUpdate.exe
Token: SeDebugPrivilege	2304	CocCocUpdate.exe
Token: SeDebugPrivilege	2672	CocCocUpdate.exe

description	pid	Process	procid_target
PID 4668 wrote to memory of 2672	4668	CocCocSetup.exe	79
PID 4668 wrote to memory of 2672	4668	CocCocSetup.exe	79
PID 4668 wrote to memory of 2672	4668	CocCocSetup.exe	79
PID 2672 wrote to memory of 2264	2672	CocCocUpdate.exe	81
PID 2672 wrote to memory of 2264	2672	CocCocUpdate.exe	81
PID 2672 wrote to memory of 2264	2672	CocCocUpdate.exe	81
PID 2672 wrote to memory of 1164	2672	CocCocUpdate.exe	82
PID 2672 wrote to memory of 1164	2672	CocCocUpdate.exe	82
PID 2672 wrote to memory of 1164	2672	CocCocUpdate.exe	82
PID 1164 wrote to memory of 228	1164	CocCocUpdate.exe	83
PID 1164 wrote to memory of 228	1164	CocCocUpdate.exe	83
PID 1164 wrote to memory of 4884	1164	CocCocUpdate.exe	84
PID 1164 wrote to memory of 4884	1164	CocCocUpdate.exe	84
PID 1164 wrote to memory of 3144	1164	CocCocUpdate.exe	85
PID 1164 wrote to memory of 3144	1164	CocCocUpdate.exe	85
PID 2672 wrote to memory of 1748	2672	CocCocUpdate.exe	86
PID 2672 wrote to memory of 1748	2672	CocCocUpdate.exe	86
PID 2672 wrote to memory of 1748	2672	CocCocUpdate.exe	86
PID 2672 wrote to memory of 3384	2672	CocCocUpdate.exe	88
PID 2672 wrote to memory of 3384	2672	CocCocUpdate.exe	88
PID 2672 wrote to memory of 3384	2672	CocCocUpdate.exe	88
PID 2312 wrote to memory of 2304	2312	CocCocUpdate.exe	91
PID 2312 wrote to memory of 2304	2312	CocCocUpdate.exe	91
PID 2312 wrote to memory of 2304	2312	CocCocUpdate.exe	91
PID 2672 wrote to memory of 556	2672	CocCocUpdate.exe	92
PID 2672 wrote to memory of 556	2672	CocCocUpdate.exe	92
PID 2672 wrote to memory of 556	2672	CocCocUpdate.exe	92
PID 556 wrote to memory of 4652	556	CocCocUpdate.exe	93
PID 556 wrote to memory of 4652	556	CocCocUpdate.exe	93
PID 556 wrote to memory of 3612	556	CocCocUpdate.exe	94
PID 556 wrote to memory of 3612	556	CocCocUpdate.exe	94
PID 556 wrote to memory of 3948	556	CocCocUpdate.exe	95
PID 556 wrote to memory of 3948	556	CocCocUpdate.exe	95
PID 2672 wrote to memory of 2520	2672	CocCocUpdate.exe	96
PID 2672 wrote to memory of 2520	2672	CocCocUpdate.exe	96
PID 2672 wrote to memory of 2520	2672	CocCocUpdate.exe	96

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads