6c21b0fb2c6bbb62b6a7de80eece5851beceb564497ed090e828ee0e394a13c6

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/coopen_setup_100030.exe
Size

1.0MB
MD5

749ee29ff4b3e34ee9c7b1fb8575a126
SHA1

3ec56a9167f4e9e0724f106c03513ed498f7ca70
SHA256

f241a7da464510479bda1b1314d70e32b8e907efa15f71dea183810502d27af7
SHA512

461410a6960063acd7294de760b161c73c0370a88f7198ecfe6169cdbe1ba809c4388940ebb154cd1e6cb628c0ef3615e83476ea4cc9fcf54991dea89227de67
SSDEEP

24576:l160aJVJgAyGBdOE+m3u84uQhzRsSFIpjaL8UzhIM39uyKkb2iDvPXLiU:l12ciwEd/4n5RsSyjalhP8PijPXLT

Score

7^/10

discovery

Malware Config

Signatures

Drops startup file 1 IoCs

Processes:

coopen_setup_100030.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Coopen²¥·ÅÆ÷.lnk	coopen_setup_100030.exe

Executes dropped EXE 1 IoCs

Processes:

Coopen.exe

pid process

3996 Coopen.exe

pid	process
3996	Coopen.exe

Loads dropped DLL 15 IoCs

Processes:

coopen_setup_100030.exe

pid	process
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

coopen_setup_100030.exe

description	ioc	process
File created	C:\Program Files (x86)\Coopen\conf\PluginConfig.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\CoopenWeather.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\MainIcon.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\image\Photo\local Photo\B_0.jpg	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Templete\CoopenPhoto.jpg	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\CheckU.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\rightarrow.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\RadioC.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\SkinClose.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\CoopenActiveControl112.dll	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Templete\ModeB_logo.jpg	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Commit.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Config.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Synopsis2.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\close.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Templete\ModeB.tpl	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\hover.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\tip.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Next.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\CoopenLottery.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Indicator2.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\CoopenMainManager.dll	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\CoopenNotepad.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\uparrow.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\uninst.exe	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\licence.txt	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Confirm.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Folder.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\RadioU.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Background.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Close.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\CheckC.png	coopen_setup_100030.exe
File opened for modification	C:\Program Files (x86)\Coopen\conf\All Users.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Play.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\setting.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Indicator1.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Message.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Notify.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Synopsis1.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\conf\ChannelListReal.txt	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Push_Cancel.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\downarrow.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\hover.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Templete\DefaultCoopenWallpaper.jpg	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\image\Photo\local Photo\B_1.jpg	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\CoopenAir.exe	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\CoopenSearchTool.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\running.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Progress.png	coopen_setup_100030.exe
File opened for modification	C:\Program Files (x86)\Coopen\image\Photo\local Photo\ModeBList.ini	coopen_setup_100030.exe
File opened for modification	C:\Program Files (x86)\Coopen\conf\Admin.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Channel.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Widget.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\leftarrow.png	coopen_setup_100030.exe
File opened for modification	C:\Program Files (x86)\Coopen\image\Wallpaper\coopen wallpaper\PicList.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Templete\ModeC.tpl	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Pause.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Button_Prev.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\SkinClient.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\image\Wallpaper\local wallpaper\DefaultCoopenWallpaper.jpg	coopen_setup_100030.exe
File opened for modification	C:\Program Files (x86)\Coopen\image\Wallpaper\local wallpaper\ModeAList.ini	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Coopen.exe	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\Plugins\border.png	coopen_setup_100030.exe
File created	C:\Program Files (x86)\Coopen\Resource\SkinFormal\Synopsis1.ini	coopen_setup_100030.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

Processes:

coopen_setup_100030.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\Desktop	coopen_setup_100030.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Program Files (x86)\\Coopen\\Coopen.scr"	coopen_setup_100030.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

coopen_setup_100030.exe

pid	process
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe
3528	coopen_setup_100030.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

coopen_setup_100030.exe

description	pid	process	target process
PID 3528 wrote to memory of 3996	3528	coopen_setup_100030.exe	Coopen.exe
PID 3528 wrote to memory of 3996	3528	coopen_setup_100030.exe	Coopen.exe
PID 3528 wrote to memory of 3996	3528	coopen_setup_100030.exe	Coopen.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\coopen_setup_100030.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\coopen_setup_100030.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528

C:\Program Files (x86)\Coopen\Coopen.exe
"C:\Program Files (x86)\Coopen\Coopen.exe"
2⤵
- Executes dropped EXE
PID:3996

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Coopen\Coopen.exe
Filesize
89KB

MD5
78723c8e15f9bbe8aa1e9b6cab6ef556

SHA1
c028ea500d5c3db6993685125638ce2f8e9e722b

SHA256
20609e1fc26bed1dc7efdb9887f4c66162e37a5efc1df7fdc0741b0a6e9eb7ba

SHA512
0af5a854efff332c284537bd342a8d0943705f5a43d77ed274bba78a84b6f0e344443112d9a4291e6e7865910460213f24445418e6eac25c50ae42b0be77a19f

Download Submit
C:\Program Files (x86)\Coopen\conf\Admin.ini
Filesize
275B

MD5
45615761fcdc2306e492801f6e5572eb

SHA1
1537e9241fabe9570c271c3e223ca26bcebd6ecf

SHA256
7b85376e33ade41a59d93312938703c1a5f78cc40cd57637fa2f668ab269fdb1

SHA512
4a2f2fbb10d58be90ce3e293d44f62054eb376e2056285cc6bf823d537c91b6478bb63213d7a8facf1db25c3c75010eed4756723c2ecdec7af4bea5a59efd30c

Download Submit
C:\Program Files (x86)\Coopen\image\Wallpaper\coopen wallpaper\PicList.ini
Filesize
183B

MD5
b2e4fcaf8fb1aca922b3256ad67cae70

SHA1
d5ac71355f67bc5775accb38b569258d1be3dac5

SHA256
02650ca3221b02dd208301ae918d8408a015d3783e5096a924884d698f598594

SHA512
d93b7b0ad7972dada79b456d8431808cc73d49808730a512a3139011a01f69393298b9c86da68b2c2338bdbc6460e57e12db2ab2c87c0be1b216df34f202f1f3

Download Submit
C:\Program Files (x86)\Coopen\image\Wallpaper\local wallpaper\ModeAList.ini
Filesize
182B

MD5
4973db85d31a71051d885aabffdd5f91

SHA1
08aa158b39486f1ed97047cf1755da40a97dd0f1

SHA256
58a7286d3e4d4f7ab7a710fe399a7e4bf098dbc6d5b0d23b5f8020511cbabfdf

SHA512
e560d87f1561b09b6379da945f1435d2d6eb84b03078da90cbd63bfaeed8947d6d052329159b88bfe765910ba34ba6a74344543ec33e0fc4ee96fa44da90884f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA7DB.tmp\KillProcDLL.dll
Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstA7DB.tmp\System.dll
Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
memory/3528-25-0x00000000023B0000-0x00000000023B3000-memory.dmp

Filesize
12KB

Download
memory/3528-50-0x00000000023B0000-0x00000000023B3000-memory.dmp

Filesize
12KB

Download
memory/3528-53-0x00000000023B0000-0x00000000023B3000-memory.dmp

Filesize
12KB

Download
memory/3528-58-0x00000000023B0000-0x00000000023B3000-memory.dmp

Filesize
12KB

Download
memory/3528-148-0x00000000023B0000-0x00000000023B3000-memory.dmp

Filesize
12KB

Download
memory/3528-154-0x00000000023B0000-0x00000000023B3000-memory.dmp

Filesize
12KB

Download