Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
996c07d0976b6f6b87096d973ab9fee7.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
996c07d0976b6f6b87096d973ab9fee7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
996c07d0976b6f6b87096d973ab9fee7.exe
-
Size
252KB
-
MD5
996c07d0976b6f6b87096d973ab9fee7
-
SHA1
58b060665f5003a0309f71d63728415bdda3bba9
-
SHA256
140df14fcc0d114aa46090044e7abeb33079c991eac25d6e5e2da262b1ce12af
-
SHA512
3f02cee6eebe52a1204962af647e687e35614e77ba1efd379f41f1dc42863938b0259855246bb4438f10526faaecc1e671affa594ba44e597d4b615b402d38ce
-
SSDEEP
6144:P+ArRyrimEU/EztV++Jbtd4lfn8hFXbTom85FxnH:PNrkrimr/EztV++JZd4lfnSTo7F
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" coiwou.exe -
Executes dropped EXE 1 IoCs
pid Process 2296 coiwou.exe -
Loads dropped DLL 2 IoCs
pid Process 1800 996c07d0976b6f6b87096d973ab9fee7.exe 1800 996c07d0976b6f6b87096d973ab9fee7.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /B" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /b" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /R" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /s" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /h" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /S" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /l" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /t" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /K" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /e" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /i" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /p" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /L" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /g" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /y" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /A" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /c" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /N" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /v" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /Z" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /a" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /d" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /q" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /z" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /w" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /m" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /Q" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /G" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /I" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /o" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /n" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /x" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /J" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /C" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /T" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /W" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /E" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /Y" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /V" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /u" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /r" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /O" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /F" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /X" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /k" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /M" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /D" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /H" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /U" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /j" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /f" coiwou.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\coiwou = "C:\\Users\\Admin\\coiwou.exe /P" coiwou.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe 2296 coiwou.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1800 996c07d0976b6f6b87096d973ab9fee7.exe 2296 coiwou.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2296 1800 996c07d0976b6f6b87096d973ab9fee7.exe 28 PID 1800 wrote to memory of 2296 1800 996c07d0976b6f6b87096d973ab9fee7.exe 28 PID 1800 wrote to memory of 2296 1800 996c07d0976b6f6b87096d973ab9fee7.exe 28 PID 1800 wrote to memory of 2296 1800 996c07d0976b6f6b87096d973ab9fee7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\996c07d0976b6f6b87096d973ab9fee7.exe"C:\Users\Admin\AppData\Local\Temp\996c07d0976b6f6b87096d973ab9fee7.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\coiwou.exe"C:\Users\Admin\coiwou.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2296
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD52cb5d462c832727cc39516d736636710
SHA11216d7b987086ed0d2647eae55356917e7736c22
SHA256d23a1124900bb71cee840de24a9d2b4aafbed6129c813380c07486a26df984a4
SHA51262aa46562fcc0a65024198b2a345b4815510487867800de7718698558f7e0b388aeecaa40945385e02a2b7ead5aa00d0176bfcb324fa20950b849636bbd639de