faf0b906501ec9fd41ba46a920055eed58ff6fa5ef227e1feb42fb66bbf23ec1

General

Target

TencentMeeting_0300000000_3.7.9.426.publish (2).exe
Size

148.1MB
MD5

fe7d7cb3026cb7e537b947964cabd2c1
SHA1

c22094f75eb5c03fd53269c4deefafb26df58b0c
SHA256

faf0b906501ec9fd41ba46a920055eed58ff6fa5ef227e1feb42fb66bbf23ec1
SHA512

b3f257e60dae651a8d547ac16a87c4aa5a58f07b0aea0c536b6a5abe0b9d4e8f14d135097a380819e58d555eb7b2fa31565bc9ba263a23468032da5085adda41

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

TencentMeeting_0300000000_3.7.9.426.publish (2).exe

pid	process
4280	TencentMeeting_0300000000_3.7.9.426.publish (2).exe
4280	TencentMeeting_0300000000_3.7.9.426.publish (2).exe
4280	TencentMeeting_0300000000_3.7.9.426.publish (2).exe
4280	TencentMeeting_0300000000_3.7.9.426.publish (2).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 4 IoCs

Processes:

TencentMeeting_0300000000_3.7.9.426.publish (2).exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\.wxe1097d193e4320fd	TencentMeeting_0300000000_3.7.9.426.publish (2).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\.wxe1097d193e4320fd\ = "wemeet launc"	TencentMeeting_0300000000_3.7.9.426.publish (2).exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\.wxe1097d193e4320fd\OpenWithProgids	TencentMeeting_0300000000_3.7.9.426.publish (2).exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\.wxe1097d193e4320fd\OpenWithProgids\wemeet = "0"	TencentMeeting_0300000000_3.7.9.426.publish (2).exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

TencentMeeting_0300000000_3.7.9.426.publish (2).exe

pid process

4280 TencentMeeting_0300000000_3.7.9.426.publish (2).exe
4280 TencentMeeting_0300000000_3.7.9.426.publish (2).exe

C:\Users\Admin\AppData\Local\Temp\TencentMeeting_0300000000_3.7.9.426.publish (2).exe
"C:\Users\Admin\AppData\Local\Temp\TencentMeeting_0300000000_3.7.9.426.publish (2).exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh812C.tmp\LangDLL.dll
Filesize
7KB

MD5
98c67ac7f1b9f37ba19db3c1dc10cf0f

SHA1
28292ac34775e4c33f9ee980b314637f22872bae

SHA256
fc934575d04b2c8b09b3cf21a87621be87c573b788ea9dff66c9be785e040443

SHA512
d496cc8595ceb285ba32868a8901b3abd276157cea375e7b31ace875c726cc63684761b373119a723399e661fc9fe55de69a6dcf9f2cd61523d96fb497c4b785

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh812C.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh812C.tmp\UAC.dll
Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsh812C.tmp\WeMeetHelper.dll
Filesize
1.4MB

MD5
09eae0df409a270b22e13fddec3bf625

SHA1
8bdce7a044fb7bf375098bdb49110c8ca5c07a71

SHA256
be71e8343c655587d99219404b2e54c5be494fae0f23ca6d675071409f2c5064

SHA512
421bba1f158adca534413ac1f1dad98494aed2490896e57493ede16985256aa926f6de6d1d5938c5a07583fcf5a57752e465706af55b8b5821aa2c52cc7d280f

Download Submit

Analysis

Sharing