Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CocCoc Update' = '"%LOCALAPPDATA%\CocCoc\Update\CocCocUpdate.exe" /c'
Creates or modifies the following files
- %WINDIR%\tasks\coccocupdatetaskusers-1-5-21-1960123792-2022915161-3775307078-1001core.job
- <SYSTEM32>\tasks\coccocupdatetaskusers-1-5-21-1960123792-2022915161-3775307078-1001core
- %WINDIR%\tasks\coccocupdatetaskusers-1-5-21-1960123792-2022915161-3775307078-1001ua.job
- <SYSTEM32>\tasks\coccocupdatetaskusers-1-5-21-1960123792-2022915161-3775307078-1001ua
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\gutafb0.tmp
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocupdatebroker.exe
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocupdatesetup.exe
- %LOCALAPPDATA%\coccoc\update\coccocupdate.exe
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\psmachine.dll
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\psuser.dll
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocupdatehelper.msi
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocpdateres_vi.dll
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocpdateres_en-gb.dll
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocpdateres_en.dll
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccoccrashhandler.exe
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocpdate.dll
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocupdate.exe
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocupdateondemand.exe
- %APPDATA%\coccoc\uid
- %ProgramFiles(x86)%\gumafaf.tmp\coccocpdateres_vi.dll
- %ProgramFiles(x86)%\gumafaf.tmp\coccocpdateres_en-gb.dll
- %ProgramFiles(x86)%\gumafaf.tmp\coccocpdateres_en.dll
- %ProgramFiles(x86)%\gumafaf.tmp\psuser.dll
- %ProgramFiles(x86)%\gumafaf.tmp\psmachine.dll
- %ProgramFiles(x86)%\gumafaf.tmp\coccocupdatewebplugin.exe
- %ProgramFiles(x86)%\gumafaf.tmp\coccocupdateondemand.exe
- %ProgramFiles(x86)%\gumafaf.tmp\coccocupdatebroker.exe
- %ProgramFiles(x86)%\gumafaf.tmp\coccocupdatehelper.msi
- %ProgramFiles(x86)%\gumafaf.tmp\coccocpdate.dll
- %ProgramFiles(x86)%\gumafaf.tmp\coccoccrashhandler.exe
- %ProgramFiles(x86)%\gumafaf.tmp\coccocupdate.exe
- %ProgramFiles(x86)%\gumafaf.tmp\coccocupdatesetup.exe
- %LOCALAPPDATA%\coccoc\update\2.5.15.13\coccocupdatewebplugin.exe
Network activity
Connects to
- 'br####r.coccoc.com':80
TCP
HTTP POST requests
- http://br####r.coccoc.com/service/update2
UDP
- DNS ASK br####r.coccoc.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\gumafaf.tmp\coccocupdate.exe' /installsource taggedmi /install "appguid={C0CC0CBB-47DD-46FF-A04D-7011A06486E1}&appname=C%E1%BB%91c%20C%E1%BB%91c&needsadmin=False&lang=en&client={3be25ea6-6935-11e2-86bc-0025904dcf7e}&brand=X...
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' /regserver
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIyLjUuMTUuMTMiIHNoZWxsX3ZlcnNpb249IjIuNS4xNS4xMyIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9InsxQzBDRkV...
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' /handoff "appguid={C0CC0CBB-47DD-46FF-A04D-7011A06486E1}&appname=C%E1%BB%91c%20C%E1%BB%91c&needsadmin=False&lang=en&client={3be25ea6-6935-11e2-86bc-0025904dcf7e}&brand=XXXX" /installsource tagg...
