Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'CocCoc Update' = '"%LOCALAPPDATA%\CocCoc\Update\2.7.1.17\CocCocUpdateCore.exe"'
Creates or modifies the following files
- <SYSTEM32>\tasks\coccocupdatetaskusers-1-5-21-1960123792-2022915161-3775307078-1001core
- <SYSTEM32>\tasks\coccocupdatetaskusers-1-5-21-1960123792-2022915161-3775307078-1001ua
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\coccoc\temp\guta0d2.tmp
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdate.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocpdate.dll
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdatecore.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccoccrashhandler.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccoccrashhandler64.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdatecomregistershell64.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocpdateres_vi.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\psmachine_64.dll
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\psuser.dll
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\psuser_64.dll
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\psmachine.dll
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\psmachine_64.dll
- %LOCALAPPDATA%\coccoc\update\coccocupdate.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdatesetup.exe
- %APPDATA%\coccoc\uid
- %ALLUSERSPROFILE%\coccoc\uid
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdatesetup.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocpdateres_vi.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocpdateres_en.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccoccrashhandler64.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdatecore.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\psuser_64.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\psuser.dll
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocpdateres_en.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\psmachine.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdatecomregistershell64.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdateondemand.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdatebroker.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocpdate.dll
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccoccrashhandler.exe
- %ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdate.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdatebroker.exe
- %LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdateondemand.exe
Network activity
Connects to
- 'br####r.coccoc.com':80
TCP
HTTP POST requests
- http://br####r.coccoc.com/service/update2
UDP
- DNS ASK br####r.coccoc.com
Miscellaneous
Creates and executes the following
- '%ProgramFiles(x86)%\coccoc\temp\guma0d1.tmp\coccocupdate.exe' /installsource taggedmi /install "appguid={C0CC0CBB-47DD-46FF-A04D-7011A06486E1}&appname=C%E1%BB%91c%20C%E1%BB%91c&needsadmin=false&lang=en&client={XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}&brand=X...
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' /regserver
- '%LOCALAPPDATA%\coccoc\update\2.7.1.17\coccocupdatecomregistershell64.exe' /user
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjIuNy4xLjE3IiBzaGVsbF92ZXJzaW9uPSIyLjcuMS4xNyIgaXNtYWNoaW5lPSI...
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' /handoff "appguid={C0CC0CBB-47DD-46FF-A04D-7011A06486E1}&appname=C%E1%BB%91c%20C%E1%BB%91c&needsadmin=false&lang=en&client={XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}&brand=XXXX" /installsource tagg...
- '%LOCALAPPDATA%\coccoc\update\coccocupdate.exe' -Embedding
