337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b.exe
Size 3.0MB
Sample260815-age44scg62
SHA256 337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b
MD5 557f87fc013dc0029b218e1a7c74bbba
SHA1 f181ea0d06e540a566f1831591fb230dd07ded7a
SHA512 7749c64ddeccbef9077c0303b39a330ba7c4be27ea6db8caec0cf3f3d9b337b6b8d25d94d92a68e4df56f4b16d4c103c032202166cf9287cbcc412cf5b539a1a
SSDEEP 98304:3AzrTNnprcGQOwzFZWUMYJBmytadcEGJr:Q9pszbfrJBmIadyh
TLSH
T14BE5333AE7678DF5E835977261A2EB0B57784D798EAE4A08FF054C336C37215D21A023
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6372	powershell.exe

Executes dropped EXE 9 IoCs

pid	Process
3520	CocCocReal.exe
4056	updater.exe
6364	updater.exe
244	updater.exe
2820	updater.exe
4652	updater.exe
4948	updater.exe
5820	updater.exe
5448	updater.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in Program Files directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\crx_cache\metadata.json	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	CocCocReal.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\CocCoc\Update\CocCocUpdate.exe	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\attachments\55b2b4ea-8c8f-403f-aaaa-99743f7df7ef\updater.log	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\7b40acde-d131-4af9-9d9a-e2409265edc2.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\attachments\55b2b4ea-8c8f-403f-aaaa-99743f7df7ef\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\344469d4-782c-4245-b484-c191e4b22644.tmp	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\3322300b-1b23-4d8a-bebd-3a5b8590497c.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\settings.dat	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\uninstall.cmd	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\092c26b0-1c31-40c9-b99b-0dc40e0b8480.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\crx_cache\062b7734-6fd9-42ff-9201-363a6475b920.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\9ecc6e52-329a-497c-bb71-f2e76d3ee228.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\092c26b0-1c31-40c9-b99b-0dc40e0b8480.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\prefs.json	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\reports\55b2b4ea-8c8f-403f-aaaa-99743f7df7ef.dmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\344469d4-782c-4245-b484-c191e4b22644.tmp	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\crx_cache\43e359c9-a849-48fc-9fd1-08315e7ae45d.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\d9adeed9-f649-49a8-a19d-84026bf7ce80.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\settings.dat	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\640b2161-c31f-4612-9636-1d6fa6210441.tmp	updater.exe
File created	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\f94c2bc2-ecbe-4ecf-94c3-643b61f104cb.tmp	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl	updater.exe
File opened for modification	C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\metadata	updater.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\CocCoc3520_525004933\UPDATER.PACKED.7Z	CocCocReal.exe
File created	C:\Windows\SystemTemp\CocCoc3520_34909940\updater.7z	CocCocReal.exe
File created	C:\Windows\SystemTemp\CocCoc3520_34909940\bin\uninstall.cmd	CocCocReal.exe
File created	C:\Windows\SystemTemp\CocCoc3520_34909940\bin\updater.exe	CocCocReal.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	6372	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CocCocReal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	updater.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A72E0E76-BF8B-48C8-BC14-DDE8254EBDA9}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3339BB5A-555B-4C33-8D97-15F78BFF5CE1}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D3F1E0CA-4039-5AB6-BC23-F2798D46291F}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9ECDA9E1-37B9-4C16-BE95-E002D0A71EDB}\1.0\0\win64\ = "C:\\Program Files (x86)\\CocCoc\\CocCocUpdater\\149.0.7827.202\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{52BDDE89-BABF-4675-A132-C4040A57FC20}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{B10D1B16-99FF-449B-833D-88093658AD2D}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F15393EF-1112-41C4-9A24-20C0F0075DC1}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3EEC3A7A-53B0-4049-BDBF-0442509F5CD3}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{56D89BD1-3C6D-4D41-BAD1-F9ECA194DE72}\1.0\0\win64\ = "C:\\Program Files (x86)\\CocCoc\\CocCocUpdater\\149.0.7827.202\\updater.exe\\6"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3339BB5A-555B-4C33-8D97-15F78BFF5CE1}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{EBB83CE2-FFD9-5E64-AAD0-9083E0018DF0}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{DA8CE3F4-ADAA-5BDA-98CF-28442519FEC2}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{D3F1E0CA-4039-5AB6-BC23-F2798D46291F}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{9ECDA9E1-37B9-4C16-BE95-E002D0A71EDB}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{FB67B162-87F3-42BC-9FDA-057618318283}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7433863-951E-4472-A67B-7202D2E538BD}\TypeLib\ = "{E7433863-951E-4472-A67B-7202D2E538BD}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3EEC3A7A-53B0-4049-BDBF-0442509F5CD3}\TypeLib\ = "{3EEC3A7A-53B0-4049-BDBF-0442509F5CD3}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{FD514DFD-AC94-5830-98BD-3BE5E73BD1A6}\ServiceParameters = "--com-service"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4AD167D1-337D-54E9-B0BE-E6C2080720BB}\1.0\ = "CocCocUpdater TypeLib for IUpdateStateSystem"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{790C7FB5-0A96-52F6-859D-0DEE370143DD}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{461D9FBA-F7A1-49AD-B73A-AFDE9C841C27}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4AD167D1-337D-54E9-B0BE-E6C2080720BB}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58C9D0DE-1C7A-484B-AC42-4704E272BA5C}\TypeLib\ = "{58C9D0DE-1C7A-484B-AC42-4704E272BA5C}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52BDDE89-BABF-4675-A132-C4040A57FC20}\TypeLib\ = "{52BDDE89-BABF-4675-A132-C4040A57FC20}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56D89BD1-3C6D-4D41-BAD1-F9ECA194DE72}\TypeLib\ = "{56D89BD1-3C6D-4D41-BAD1-F9ECA194DE72}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEB78192-82FD-49B8-ADFB-72A4EF44CF53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F2423F4C-65FB-438D-BBDC-07D15CB094F5}\1.0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{C03FA994-A3FC-4F46-A162-F02D8049EFB3}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C03FA994-A3FC-4F46-A162-F02D8049EFB3}\TypeLib\ = "{C03FA994-A3FC-4F46-A162-F02D8049EFB3}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{A21C3A65-2FE5-5852-881A-9ADD24E2A7DB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{790C7FB5-0A96-52F6-859D-0DEE370143DD}\1.0\0\win32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EBB83CE2-FFD9-5E64-AAD0-9083E0018DF0}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D54AF22-0BBB-5F93-A093-8F4D948C70F6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ECDA9E1-37B9-4C16-BE95-E002D0A71EDB}\TypeLib\ = "{9ECDA9E1-37B9-4C16-BE95-E002D0A71EDB}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E7433863-951E-4472-A67B-7202D2E538BD}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F15393EF-1112-41C4-9A24-20C0F0075DC1}\TypeLib\ = "{F15393EF-1112-41C4-9A24-20C0F0075DC1}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F15393EF-1112-41C4-9A24-20C0F0075DC1}\TypeLib\ = "{F15393EF-1112-41C4-9A24-20C0F0075DC1}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9AEB1CC-DF9B-45CB-B70B-084D2E869A1C}\AppID = "{B9AEB1CC-DF9B-45CB-B70B-084D2E869A1C}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{4AD167D1-337D-54E9-B0BE-E6C2080720BB}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EB06C97-8B0C-43FF-8485-B9B08E702728}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4975912A-17C1-40D4-BCF5-1190E476FE82}\TypeLib\Version = "1.0"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960616C8-29B9-45B0-8BF1-6F3261818B23}\ = "IPolicyStatus3"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4AD167D1-337D-54E9-B0BE-E6C2080720BB}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{A060D27F-C2A8-5AA9-97B1-CBCAF5A5B2DE}\1.0\0\win32	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52BDDE89-BABF-4675-A132-C4040A57FC20}\ = "IPolicyStatus3System"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F15393EF-1112-41C4-9A24-20C0F0075DC1}\TypeLib	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{3EEC3A7A-53B0-4049-BDBF-0442509F5CD3}\1.0\0	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{A72E0E76-BF8B-48C8-BC14-DDE8254EBDA9}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{C03FA994-A3FC-4F46-A162-F02D8049EFB3}\1.0\0\win64	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4AD167D1-337D-54E9-B0BE-E6C2080720BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A21C3A65-2FE5-5852-881A-9ADD24E2A7DB}\TypeLib\Version = "1.0"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{58C9D0DE-1C7A-484B-AC42-4704E272BA5C}\TypeLib	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25313B09-1D01-4F2E-91CB-0DF8EE09D633}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{FB67B162-87F3-42BC-9FDA-057618318283}\1.0\0\win64	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C2F7B879-966A-462F-88A9-381E181214B0}	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{3339BB5A-555B-4C33-8D97-15F78BFF5CE1}\ProxyStubClsid32	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{4975912A-17C1-40D4-BCF5-1190E476FE82}\1.0\0	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{15D966C1-9B68-5225-99DC-29EBA544D9E9}\TypeLib\ = "{15D966C1-9B68-5225-99DC-29EBA544D9E9}"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{F84B3929-A665-5D2F-892F-1E200B8737B0}	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4AD08AF7-2336-437D-913C-407F85E2F0BE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	updater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4AD08AF7-2336-437D-913C-407F85E2F0BE}\1.0\0\win32\ = "C:\\Program Files (x86)\\CocCoc\\CocCocUpdater\\149.0.7827.202\\updater.exe\\6"	updater.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{56D89BD1-3C6D-4D41-BAD1-F9ECA194DE72}\ProxyStubClsid32	updater.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
6372	powershell.exe
6372	powershell.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
4056	updater.exe
6372	powershell.exe
4056	updater.exe
4056	updater.exe
244	updater.exe
244	updater.exe
244	updater.exe
244	updater.exe
244	updater.exe
244	updater.exe
4652	updater.exe
4652	updater.exe
4652	updater.exe
4652	updater.exe
4948	updater.exe
4948	updater.exe
4948	updater.exe
4948	updater.exe
4948	updater.exe
4948	updater.exe
6364	updater.exe
6364	updater.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	3520	CocCocReal.exe
Token: SeIncBasePriorityPrivilege	3520	CocCocReal.exe
Token: SeDebugPrivilege	6372	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3520	4608	337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b.exe	91
PID 4608 wrote to memory of 6372	4608	337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b.exe	92
PID 3520 wrote to memory of 4056	3520	CocCocReal.exe	94
PID 4056 wrote to memory of 6364	4056	updater.exe	95
PID 6372 wrote to memory of 6028	6372	powershell.exe	97
PID 244 wrote to memory of 2820	244	updater.exe	98
PID 6028 wrote to memory of 3476	6028	csc.exe	99
PID 4652 wrote to memory of 5820	4652	updater.exe	106
PID 4948 wrote to memory of 5448	4948	updater.exe	107

C:\Users\Admin\AppData\Local\Temp\337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b.exe
"C:\Users\Admin\AppData\Local\Temp\337fa640fcc88f6b779e076ae632a988cb6911cdc811871018f839e98f29226b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\coccoc_setup\CocCocReal.exe
  "C:\Users\Admin\AppData\Local\Temp\coccoc_setup\CocCocReal.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SystemTemp\CocCoc3520_34909940\bin\updater.exe
    "C:\Windows\SystemTemp\CocCoc3520_34909940\bin\updater.exe" --install=appguid={C0CC0CBB-47DD-46FF-A04D-7011A06486E1}&appname=C%E1%BB%91c%20C%E1%BB%91c&needsadmin=prefers&usagestats=1&lang=vi&client={XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}&brand=XXXX&ap=arch_x64 --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=2
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\SystemTemp\CocCoc3520_34909940\bin\updater.exe
      C:\Windows\SystemTemp\CocCoc3520_34909940\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad" --url=https://browser-crashes.coccoc.com/cr/report --annotation=prod=CocCocUpdater --annotation=ver=149.0.7827.202 "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log" "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl" --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2ec,0x12491c8,0x12491d4,0x12491e0
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\coccoc_setup\payload.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rmqcqea2\rmqcqea2.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8311.tmp" "c:\Users\Admin\AppData\Local\Temp\rmqcqea2\CSCE68F113DC1DF4844AB1BF9292D060F2.TMP"
      4⤵
      PID:3476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 2288
    3⤵
    - Program crash
    PID:2812

C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe
"C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe" --system --windows-service --service=update-internal
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:244
- C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe
  "C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad" --url=https://browser-crashes.coccoc.com/cr/report --annotation=prod=CocCocUpdater --annotation=ver=149.0.7827.202 "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log" "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl" --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0xbb91c8,0xbb91d4,0xbb91e0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6372 -ip 6372
1⤵
PID:3188

C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe
"C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe
  "C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad" --url=https://browser-crashes.coccoc.com/cr/report --annotation=prod=CocCocUpdater --annotation=ver=149.0.7827.202 "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log" "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl" --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0xbb91c8,0xbb91d4,0xbb91e0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5820

C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe
"C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe" --system --windows-service --service=update
1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe
  "C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad" --url=https://browser-crashes.coccoc.com/cr/report --annotation=prod=CocCocUpdater --annotation=ver=149.0.7827.202 "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log" "--attachment=C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl" --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0xbb91c8,0xbb91d4,0xbb91e0
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

55b2b4ea-8c8f-403f-aaaa-99743f7df7ef.dmp

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\reports\55b2b4ea-8c8f-403f-aaaa-99743f7df7ef.dmp
Size 307KB
SHA256 3e6ab227d5f6c3abcfe8132ee10137e8e7d928b1603bce56c73938841d8b09ee
MD5 3f2c937ef60b4bbbd7ef51fb10e305d0
SHA1 eb1eac1360b7ed215bdd825e608ef2388561d879
SHA512 f652810c152b44a171d29646f5def1b98e7b731e445df010aee4e5bf4164bb83f3b5c07975988e23028a8bc996c9bc8604fa90bec31e0da9bbf904ebd7b76dbd
SSDEEP 3072:26btRQ8H0gQYApfTvldJegn79LsRYHRUtp:Lb8jYAJLlCgnZLYYHRUtp
TLSH
T16D64B512F39948A7D91607B25CE7AB603BF1F8150B67874733A043AF2C77798AD72A05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\149.0.7827.202\Crashpad\settings.dat
Size 40B
SHA256 a8cdcc5e754b7352de0341743fb65f6a57f73b2a240e3c5d9b0d7f9c4c89c42d
MD5 09a1026feb8d7a93844a02864e362116
SHA1 cc2e3687fc4ea73123b956fb9c475c4579e80843
SHA512 d9a06b5bc8c831e0d075e2fe82d1ead6523ac0773c3b95b2f441e8b7491d25d365390ecbab553fbf28f4f3a1114ef8d4055a1d0ddbd54e2404e72e6b827ec95e
MD5 SHA1 SHA512

Submit Download

prefs.json

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\prefs.json
Size 234B
SHA256 7a4bd84910c086677c817acf13e5f87a6b810173948a0a394714c44584a0c716
MD5 e759c3ea6ab6565322b91748d06f02f6
SHA1 13a110ccfce2a804e5f8becd48f12fca2aa5d205
SHA512 ce0aaaa28a29a5757f91093d061e058b35dce6ac4af11bac618156ca80a0b69a28df22f6c0ad9258fcd8867211179313416368b012aca3d2744a646c97f3d40e
TLSH
T160D0A9684C3181A3FC200AAF82469AA4A7E718C2026D119064EE084F0A9ACACE80B44B
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\prefs.json
Size 51B
SHA256 99f83a8bcbfd79f751c05e3c60041bbe76a86f229ad81b349b68b24fa30d00b1
MD5 ffb8a6e03638d684387e6b112bd81d56
SHA1 36feb865a45e83c42d41fa09a0cccbd62614b9da
SHA512 9e9ce6e7c790fa97956260ed26a80180476fef18b0103a8a5110342812286ec48804a2e2f0d52d4468642c8763bbd357101f20ffdb0bcf60a591d190a32bd96c
TLSH
T15990045104315031FC34075F43015D70535150D0517D4054307D14030FD5C741410107
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.json

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\prefs.json
Size 85B
SHA256 dd63abe12aacd50a6686b9e6448d384d3b9a0ed5cd51ef49c013b2c0a7540d15
MD5 77785767084d0974f3f5bc016ff2b9f1
SHA1 0fe80f706ffbf64e4f8e382797c83359c0de489e
SHA512 8eac399fdbdb7110e532ce81b66cf1e664e6318e36472a5a5a8b062066440f088aee2242944986eb5143414d514dcafca3ec4d2766a18f136487467ef768ad17
TLSH
T116A012200430C431B811468F02054950DBA400C311580181309C00070A92C69540120F
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 3KB
SHA256 8a68aeb7e512d8dca31e70c8edbc96ae2dbc88f35d6eee453d4fdc7de17d4999
MD5 ebe90c02917aa41118939bac36481048
SHA1 3843c85f30174fa1b85e43155741d9a5e86b2d0a
SHA512 7bfbd9cee2f30a10505a528d5840f4afb20b0ad339d4b204e526a22d94fbf18a4185d2c8c036eafe5bde7b55973ebaabdb4aab5f84114782b0c5d76e61bbf04f
TLSH
T12A5141E09625847724893DAEBF50970BA56D00E88792747173DEA50CBBC3C3A1ECD347
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 3KB
SHA256 5ab2e51c169a77d67091bf0a4447524b3117fb314f0367f6b0f1302a70e44acf
MD5 6fe13d7c4a7cd16e74b2c8327fc2ed0a
SHA1 07fda436eb220a276eb1e56adacb4944da037ab8
SHA512 27d1c35f9f3193e61124a48905acaf35d240c762e7acade0fc83659bf43194b9d175ec163898e12577bec78479e0d94f5b2677e8ac9cf8cccdf10ea36e048e2e
TLSH
T1D57131B0972A897769492CAEBF50574B65AC01D583D270B177CA920CBAC3C371E8C38B
MD5 SHA1 SHA512 TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 8KB
SHA256 6c185972a5c0220baaa60c13c9ed5e3262cbd47035da010492323406ac320051
MD5 4795c725be1bdf29688940af05eb6528
SHA1 bc37ea6ca2cf88b41e1370a57cff0e052976ec38
SHA512 0d79d150a026583fdcd4c9a5de620a64b431fe286f6ef0f67e9682daebc305c921a8f2576250f8f667099dd01ed8bac479f11e6aae2e7da7d50081b996f33898
SSDEEP 96:BSgCANCQwJZ5trwXCM9/CTWWOj3dVG44oMgtCjR9wMmTw9RQ+tixk:qxQsHrrM9qCWOj3dVcotU1CBaOk
TLSH
T1910223B18B2BC9BB754D2CAEBF60124A359C41D643D6646273DE420CBAC7D371ECD24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 12KB
SHA256 7e6ad055ab9a68ecfbb2cb6e9341671833eb4ee517c4f6452ec5474b9c3ef510
MD5 f776eabc9e17eff9a1c112e84e9e5e5c
SHA1 762347aa0281cf6a33fbc55a8c20ffd0b9cf7af7
SHA512 f47741f57223caa2c832dabdd1d6098acb83a39d02532439a1546a46ce921dd7803d0fac32fa78d6964578df1c056d2d2aa68d1e09b8204f32a80c7156fdd435
SSDEEP 192:qxQsHrrM9qCWOj3dVcotU1CBaO0DyAPWgUOi+Eiek4EBh3:qxznjoGzfsA3
TLSH
T10D421070CB2BC9BF751D2DAFAF60124A249D80D687D5642273EE020DF5D7D761E8C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 16KB
SHA256 16873783f8222ab33e085ac2dc975f0854edb1f8124f22da89423ec49ecd96b2
MD5 6164c5981bddf6efc852b64811f1d5e6
SHA1 f6a5b62fb7c89f680c111244ed32402cacca39c3
SHA512 196e4cf6ddecdfab23483c0b099ac491a7ba1ff3811c66a80154de00207ca1d12f2d7b2f0269a59dc3ddbf54f5b8d101ad6877294f392d832517b38256886570
SSDEEP 192:qxQsHrrM9qCWOj3dVcotU1CBaO0DyAPWgUOi+Eiek4EBhFX3qWoq8DrLyr+rebhA:qxznjoGzfsApCCqZ
TLSH
T1377222B1CA1BC9BB751D2DAFAF60220A759D40D683D56422B3DE120DF5C7D371E8C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 19KB
SHA256 2a27febc0d236f6d2f7d3de7803c49ed420b5bc7a835d044ef0a902b4176d1e8
MD5 2229f1f282456aa7892b31be23b70da6
SHA1 1d39a1c8bc5e1fae977aa6ed9bfd1b352a251812
SHA512 90c110073ebca388619a68f3dc88a3120c61700e2af22b0fdb36d9238bb16e3e52f6437e9f873030ac419d86b1343c373fcf322e37d1f60b3d3cfadff86f6e85
SSDEEP 192:qxQsHrrM9qCWOj3dVcotU1CBaO0DyAPWgUOi+Eiek4EBhFX3qWoq8DrLyr+rebhW:qxznjoGzfsApCCqm+9
TLSH
T187922060CA1BCDBF35192CAFAF60124A399D80D783D56422B3DE120DF5D7D761D8C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.log

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater.log
Size 22KB
SHA256 f65673929f2a045c36763bf0dfaaa72324aa7c0622df29c25a477cebdf43d663
MD5 ffcfb1d0ebcb4bd1aaa4afe28452e9a2
SHA1 37e0566c54e36d2c9a139d8b586a06b4831aec8b
SHA512 c686f6a505333bdc2f0f648c487e6a2b0def685125914d63cbfc3f08a2ecb64b3dc80c9bf452f163759233e9c429964797d50fcc0ced4f09516ccaaf273de3b9
SSDEEP 192:qxQsHrrM9qCWOj3dVcotU1CBaO0DyAPWgUOi+Eiek4EBhFX3qWoq8DrLyr+rebhc:qxznjoGzfsApCCqm+jQS
TLSH
T1CBA22061CA17CDBF75182DAFAF61524A399D80D383D56822B3EE060CF5D7D361D8C28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl
Size 1KB
SHA256 6c449815ef45f43da05ed2b692a33a91cf234fa3e0a3c7060f109728784afc9d
MD5 3ed8d1a913b03a38e80d00320edd80ab
SHA1 72aee0cc3fc5624a532cbeade34e611c3a17e0e9
SHA512 d70beb8a0b1dc87c5053dd5fea53641b77a240fe73735e96f57924257f79d5de77823f645e1090517a291105f91a484bf72a02c7cd89448a98f19a1999ac11db
TLSH
T193319AD13039D020FD571DC473D92A67B179149481A1C1DD39C49F5CABC28361A7E153
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl
Size 3KB
SHA256 38e4543867729b99593a1acf4ef606317b489e4e8c901b6dfc40f7a19379ae93
MD5 b09fc307fe68f4b5ab1e5ec39dcf26db
SHA1 54e66d54d194d224344e0efb683923122a83c74b
SHA512 ba84b94df2772237cb8f7963b606a778bb73df9714bd1da2dbd9dec4a9dc54a7929d9e877c00533d09ad367f43e768885600106d4d43303f88daa747b9b050bf
TLSH
T1396165D1303AC420FD1756C433D52D67B26A25A581A182CA35C49F5CABC687A257E177
MD5 SHA1 SHA512 TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl
Size 4KB
SHA256 801086e23214f7dd7fa7b970419fb669f34b4a2c1392608aba6df1afd6eb1170
MD5 4d8ce3673b1202736017ad0199066834
SHA1 2883310d2fb343f81f0842987979769b7365ed8e
SHA512 1a8d5f34d0721a2ef22510d5efc6937d755964a45eff8d3496e852380179826df76bf7731f6105f15e316ac4541558f73d84fa7a0ce7d3a239b1df60455b9b5e
SSDEEP 48:Ybdy5IaFJfL5Nvwb9R9e9ga5GkFQ0FSvY9qRYh5+6fp9Rb9R9e9c5fvh65603mhy:LCoudoSDRYZcA03rd
TLSH
T1B1A175C2203AC430FD2756C033D62967B2B934A4C2E183CE35D5AF5C9BC686A257E1B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl
Size 6KB
SHA256 bd84d5f595d09db4421a7380db98e9be80e36f4475e8affb674a771f4735d35b
MD5 e2478db9fa684b8362f2e1e36e144236
SHA1 97de34dcd48cc3f19cd57cb6e79b98f7a173f256
SHA512 53c2bbf3e05469df2a125c9a670f901e57c3d0a931dc1ef45a43da0384eb7ecb99cd3cf9305b6096d9abc67a5ef70d4384cd3c6ec1bfb9f04fb86c44f7aea697
SSDEEP 48:Ybdy5IaFJfL5Nvwb9R9e9ga5GkFQ0FSvY9qRYh5+6fp9Rb9R9e9c5fvh65603mhH:LCoudoSDRYZcA03rm
TLSH
T118D155C2203AC420FD1756C133D62977B2A928A9C2B182CF35D49F5CEBC696A257E177
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl
Size 7KB
SHA256 eacc3d833dc22d5494525f82d036572ff91c64eb648ba909ca647e7aa625574d
MD5 5e54f8ac3826e0962d20da38772d97f5
SHA1 5335922a96e909020c308ea914f0b7fefbb3c2e1
SHA512 2edc024b43a10b4ca1b3432911e6c1e7eb2ca5f5d8afead6c13f50cb4b37a2d9058e315adffc3a4d2c5cd4b895d45a6c877911e23ccd1657a976064610bcd46e
SSDEEP 48:Ybdy5IaFJfL5Nvwb9R9e9ga5GkFQ0FSvY9qRYh5+6fp9Rb9R9e9c5fvh65603mh8:LCoudoSDRYZcA03rPw4H
TLSH
T180E187C2302AC820FD1755C133D52863B2A538E9D2F193CE35D4AF5CABC696A257E17B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater_history.jsonl

Path C:\Program Files (x86)\CocCoc\CocCocUpdater\updater_history.jsonl
Size 8KB
SHA256 5cf50e743d62b97c204d5792c6b13193430544ccfce427f172b3bf0da3d719ae
MD5 8feb389acc5cebd55d4725a01160b04f
SHA1 e29e2fc63a2194ea9b0b236cb7ca441b994cc994
SHA512 1c41233b0c35ecd196e67697bd894f3ea87b931f0a2c6c0af0fda476f181b757a0fbed241bfd99b2bbdcc3c3b39193f9e1b76bd7c0cecc363a194908f23aa0ad
SSDEEP 48:Ybdy5IaFJfL5Nvwb9R9e9ga5GkFQ0FSvY9qRYh5+6fp9Rb9R9e9c5fvh65603mhF:LCoudoSDRYZcA03rPw4qbw1U5ZdEhn72
TLSH
T1CA0297C3302AC824FD2755C133D52967B2A478A8D1E083CE39D45F5C9AC696E29BE16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES8311.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8311.tmp
Size 1KB
SHA256 42ef947aef5b6394f757b738547ff3e9e7fd62c4f5fc72c7884242d4f38ed6a8
MD5 295596d20a07e3f0f387880c7555dab0
SHA1 aca2a99ed42534af9b903319ee585861e39cd7e2
SHA512 ecd0cc6597fc6cb2c744d68afed533d9249a709866d5d539744163fc20ac368eba7bf1918c52b341b475865a9c96e42dca4e9e6de9090b27d8ce6dedc46c75dc
TLSH
T17A21CC0553E9CB0FF0735B3169FA232F9534FE54DFA2976A8940422D2C11604EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

CocCocReal.exe

Path C:\Users\Admin\AppData\Local\Temp\coccoc_setup\CocCocReal.exe
Size 13.0MB
SHA256 7bd45b747077934cb5d27f6d68294b9b60b690639ae5cdfc9601e733493bc9e5
MD5 6153c3b6724ef0dae16aaa5c15e35fe3
SHA1 6ac195132a3090f23a15f9ec3d47b1f4f199509e
SHA512 79990d706660a6b1f6b5e19a595ab8aa2ab14783ca2d8e527f108adc1764813fc374eaf177891519ec493eabfe3b23ba834607d1c1aa29d733b8e3d44ce60e47
SSDEEP 393216:cqzK5DTEcEaIfcNWOjelWXdDrqNLYXcehylELjiDHvoZDCGNIwBT9KZzt:90dYZG9sp
TLSH
T15CD69D02A5A05075F4A32232B93D73798D31BE629F3585CF86507CD41F78AE2653A3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

payload.ps1

Path C:\Users\Admin\AppData\Local\Temp\coccoc_setup\payload.ps1
Size 1KB
SHA256 c820bdd54346fe2d4b35af9f5ff8d32956bb1fb3d01b385495effe655d7bbd44
MD5 88db84e23f26633e5d86be6563b0b748
SHA1 669517d35ac201d4b4bd7972b66252cb5cf05b3b
SHA512 e401a1baa9f17d46c14d54faa2da691cbe9712a008bf06020907e0b7fe5d124b42f9d4bc02a8a5dffeb975b4f262bb2c2319e14a092f3f5eebf687c1298d69a8
TLSH
T1B02144002344EB7C184B6966FE5980BDF1E2E075219C0D159BBDCAC31C26649313EB94
MD5 SHA1 SHA512 TLSH

Submit Download

rmqcqea2.dll

Path C:\Users\Admin\AppData\Local\Temp\rmqcqea2\rmqcqea2.dll
Size 3KB
SHA256 631fb8772aae75d3b1d6d4750586504b0013653cbd88ca2784a7ffe7be7f8b95
MD5 54e17b2168cffaf50d56e18d598a143b
SHA1 557c41aab601802ccb5decbacd4f8ae7d2520afb
SHA512 5c6b10d608f609bc6beb40a29b9ba346f2951840639e1c05a1ab5d25f311c1a5a68dee64aa4e276f2baf1566b78b7d54c695b739f3f1e5c3a5414b92eb65c282
TLSH
T1CB71CC1A93E8862BF4B70B31AEF3475367A4F8509BB2935E09C0032E6C617245931BB1
MD5 SHA1 SHA512 TLSH

Submit Download

uninstall.cmd

Path C:\Windows\SystemTemp\CocCoc3520_34909940\bin\uninstall.cmd
Size 653B
SHA256 91e7813ff080841ac892b77e2fbf752f4a5b0a8c073348b0141842a5e70f5fcf
MD5 64803c9d10fb96300fdef5d820e65c5a
SHA1 68426bbdb372db65bace128b323fcd92fa4fd40b
SHA512 5db817ac26ac998a5ac4765bf42a4e0a74555b3581c1e749e65f7cd3693354bc695dbc7c2b394e06d0b0f1e6f9e36565e3e226dea5c4c5949212252c9231eee9
TLSH
T1CDF0FE2E32C7A23006F223A05B0EC2456641C0FF132C7111315743992F7E4D30AE778E
MD5 SHA1 SHA512 TLSH

Submit Download

updater.exe

Path C:\Windows\SystemTemp\CocCoc3520_34909940\bin\updater.exe
Size 8.0MB
SHA256 a658b562f4621fdc26b7273173115edb21c41b239ac1445c1d78bea0242eb10b
MD5 9110c56f3b3a3209073c7927b6b7a743
SHA1 9db405bea6ac373759790536a5bf3ea232a2c585
SHA512 dbe356075992b929969e0c1bc151fffd3eddafd83ee812b7a5694903a4c07d0cf4959c4c93f305bf91d909418964c5bfff6ec9650ff041683e43b2c5c2e780f3
SSDEEP 196608:tDrXaZf/FhYXcehyuQUZdvzjiDHvoZDCGNBywoAT9K8WZse:tDrqNLYXcehylELjiDHvoZDCGNIwBT9O
TLSH
T16B869D12A5605025F4A32232B93D73798D62BE679F3185CB46503CD41FBCBE2653A3AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCE68F113DC1DF4844AB1BF9292D060F2.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rmqcqea2\CSCE68F113DC1DF4844AB1BF9292D060F2.TMP
Size 652B
SHA256 c9d78e5b871797de1d62b4f25984fc40cbf79382e8d1d1556a7eae6a9e1dd173
MD5 60594ef1b123a682be4a5aec2c557741
SHA1 e4650ec1d70394906121088c47eb272d40939bd9
SHA512 f6ac7c9426063e3cde0afb6cb2535ac080255cd531ba031903120141cefaaf70806da3e9d74b51e5e49e5e87d37aded26e701412f923140948ce2c8454232084
TLSH
T1B8F05E0963F8420EF0F35F30BDF6536395A9BD64DE7293ED1484431D2864A109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rmqcqea2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rmqcqea2\rmqcqea2.0.cs
Size 365B
SHA256 d5d1603c7fe6c651962d8af60aa15852ca013e89e322025034aed91efa6accd1
MD5 2b7ef3bbd920b58749aec60437c3f6ef
SHA1 1901a56f475473a46cb42ed4422fbbeeed37dbb8
SHA512 9bd5edb08fa7910516ed1a62b3e33e86a7e0c238fc438b01a7ac096d12eb108e34dec40389560baf3e8d9bd1b857147c7439961cff943eb05b8e772a82a9c63e
TLSH
T152E0DF541685E36534C7996DCDC9D0AEE213E0B063FC3A004BEC57524C4604A4377B25
MD5 SHA1 SHA512 TLSH

Submit Download

rmqcqea2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rmqcqea2\rmqcqea2.cmdline
Size 369B
SHA256 c0a0daba54036d42bcb603a21c3263492689ac5e272f2ce09bbaec5f36266985
MD5 94f97d108c2e6c3d7fd6fedd6ce5b615
SHA1 5ecd4b4ad11464a44240fd8e639c213248da8dec
SHA512 0e1fd2aba35bf8df74546fb87d2aedee47218060e48919811faf0fea1038961b6de3555efbc0ceab8ab12c030193ece028f7a8a8d57369e9ff2580cf591020e8
TLSH
T1DDE0C02A43C6C27E09DD2877236AC4ACCA72075B29813F845040441FD01740027E1761
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4608-10-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/6372-45-0x0000000007B90000-0x000000000820C000-memory.dmp

Download

memory/6372-24-0x00000000054F0000-0x0000000005B3A000-memory.dmp

Download

memory/6372-32-0x0000000005C20000-0x0000000005C86000-memory.dmp

Download

memory/6372-41-0x0000000006180000-0x000000000619E000-memory.dmp

Download

memory/6372-28-0x0000000005480000-0x00000000054A2000-memory.dmp

Download

memory/6372-29-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download

memory/6372-40-0x0000000005C90000-0x0000000005FEB000-memory.dmp

Download

memory/6372-46-0x0000000006760000-0x000000000677A000-memory.dmp

Download

memory/6372-25-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/6372-68-0x00000000073A0000-0x00000000073A1000-memory.dmp

Download

memory/6372-94-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/6372-19-0x00000000743A0000-0x0000000074B5C000-memory.dmp

Download

memory/6372-42-0x00000000061A0000-0x00000000061EC000-memory.dmp

Download

memory/6372-14-0x0000000004CD0000-0x0000000004D06000-memory.dmp

Download

memory/6372-13-0x00000000743B2000-0x00000000743B3000-memory.dmp

Download

memory/6372-67-0x0000000007390000-0x0000000007398000-memory.dmp

Download