icedid | 9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2023, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZoomInstallerFull.exe
Size 76.4MB
Sample230103-gbv2psde21
SHA256 9108e1d22d74bc5397b8886edc4f0a84b8906436a648ef8a86f30cf7e08978dd
MD5 aeb04e767a408e5ac643cd467751afff
SHA1 cc2b84718bcec1fe34b3e9189762149f4a91fc23
SHA512 d7e4e4c523290ac5afec1382c275dacc8a1657d7a75c2298c3bbf1fe7881253a3b5005895b72954f5062f6cd25a52df6f72c4d0022335f2349c6ede2d0e66114
SSDEEP 1572864:jpDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGsF:9DLfrQQ/FA3RAicfUjByfFIDJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

icedid 3280585787 banker loader persistence trojan

Malware Config

Extracted

Family

icedid

Campaign

3280585787

trbiriumpa.com

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	452	rundll32.exe
6	4768	msiexec.exe
12	4768	msiexec.exe
24	1448	msiexec.exe
54	452	rundll32.exe
56	452	rundll32.exe

Executes dropped EXE 3 IoCs

pid	Process
1920	ZoomOutlookIMPlugin.exe
636	CptInstall.exe
3592	CptService.exe

Loads dropped DLL 14 IoCs

pid	Process
452	rundll32.exe
3912	MsiExec.exe
1920	ZoomOutlookIMPlugin.exe
1920	ZoomOutlookIMPlugin.exe
1920	ZoomOutlookIMPlugin.exe
1920	ZoomOutlookIMPlugin.exe
1920	ZoomOutlookIMPlugin.exe
1920	ZoomOutlookIMPlugin.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zoommsirepair = "\"C:\\Program Files (x86)\\Zoom\\bin\\installer.exe\" /repair"	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f359.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f470-1f3fb-2640.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f558.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3ff-2696.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f6b4-1f3ff-2640.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9cf-1f3fd.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f455.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3fb-1f91d-1f468-1f3fc.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f468-1f3fc-2764-1f468-1f3fe.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f9bd.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f487-1f3fd-2640.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f6a3-1f3ff-2640.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3fb-2696.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d7-2640.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f90f-1f3fc.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3fd-1f91d-1f9d1-1f3fe.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\bin\libcrypto-1_1.dll	msiexec.exe
File created	C:\Program Files (x86)\Zoom\bin\MailClient.dll	msiexec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f3-1f1ea.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f3a5.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f482-1f3ff.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f48f-1f3fc.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1e8-1f1fc.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f5-1f1f9.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f48d.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f937-1f3fe-2640.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d1-1f3ff-2764-1f9d1-1f3fd.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1ea-1f1f7.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1eb.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f469-1f3fd-1f9b2.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f477-1f3fd-2640.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f3c3-1f3fc-2642.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f50c.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f551.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f63e.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f935-1f3ff-2640.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d3-1f3fd.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\002a.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f466-1f3fd.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f473-1f3fc-2640.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f493.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f64b-1f3ff-2642.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f359.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f47c-1f3fd.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9d3-1f3fb.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\bin\aomhost64\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1e7-1f1ea.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f5-1f1f8.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f8.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f468-1f3fd-2764-1f48b-1f468-1f3fe.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1fa99.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f1f7-1f1fc.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f490.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f6b4-1f3fd-2640.svg	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f939-1f3fb-2640.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f9a9.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\emoji-categories.json	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f47d.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\270b-1f3fd.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f473.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f575-1f3fe.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f590-1f3fb.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Zoom\resources\Emojis\1f64e-1f3fc.png	MsiExec.exe
File created	C:\Program Files (x86)\Zoom\resources\Emojis\1f932-1f3ff.png	MsiExec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI448B.tmp	msiexec.exe
File created	C:\Windows\Installer\e573cae.msi	msiexec.exe
File created	C:\Windows\Installer\{D2D52E89-6EC4-456C-ACDB-874925BDE05A}\_6FEFF9B68218417F98F549.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{D2D52E89-6EC4-456C-ACDB-874925BDE05A}\_6FEFF9B68218417F98F549.exe	msiexec.exe
File created	C:\Windows\Installer\e573cab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e573cab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D2D52E89-6EC4-456C-ACDB-874925BDE05A}	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000b9e60d2ecf4958f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800000b9e60d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809000b9e60d2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000b9e60d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000b9e60d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppPath = "C:\\Program Files (x86)\\Zoom\\bin"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\Policy = "3"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Zoom.exe = "11000"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\zoommtg	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\zoommtg\WarnOnOpen = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AFDA28A5-1B5F-4635-9877-73DF0D710C9A}\AppName = "Zoom.exe"	MsiExec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	CptInstall.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ZoomOutlookIMPlugin.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ZoomOutlookIMPlugin.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ZoomOutlookIMPlugin.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	CptInstall.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoommtg\ = "ZoomLauncher"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\shell	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPhoneCall\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\497B918CC54A72F48906C06894A225CC\98E25D2D4CE6C654CABD789452DB0EA5	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.im	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\zTscoder.exe\" \"%1\""	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall\URL Protocol	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\ = "URL:ZoomPhoneCall Protocol"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\shell\open\command	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\DefaultIcon	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98E25D2D4CE6C654CABD789452DB0EA5	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoommtg	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher\shell\open\command	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\URL Protocol	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoom	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomLauncher	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\shell\open	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall\shell	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.tel	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\ = "URL:Zoom Launcher"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\DefaultIcon	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoom\ = "ZoomRecording"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPhoneCall\ = "URL:ZoomPhoneCall Protocol"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPhoneCall\URL Protocol	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\URL Protocol	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.zoommtg\Content Type = "application/x-zoommtg-launcher"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\shell	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\ProductIcon = "C:\\Windows\\Installer\\{D2D52E89-6EC4-456C-ACDB-874925BDE05A}\\_6FEFF9B68218417F98F549.exe"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\Version = "84683162"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.callto	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-zoommtg-launcher\Extension = ".zoommtg"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\shell\open	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall\ = "URL:ZoomPhoneCall Protocol"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\shell	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\497B918CC54A72F48906C06894A225CC	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\callto	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\ = "URL:ZoomPhoneCall Protocol"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPbx.zoomphonecall\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\AuthorizedLUAApp = "0"	msiexec.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.im	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPbx.zoomphonecall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomPhoneCall\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" --url=\"%l\""	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\98E25D2D4CE6C654CABD789452DB0EA5\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\98E25D2D4CE6C654CABD789452DB0EA5\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\shell	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\ZoomPhoneCall\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\UseOriginalUrlEncoding = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\DefaultIcon\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\",1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zoommtg\shell\open\command\ = "\"C:\\Program Files (x86)\\Zoom\\bin\\Zoom.exe\" \"--url=%1\""	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZoomRecording\ = "Zoom Recording File"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
452	rundll32.exe
452	rundll32.exe
1448	msiexec.exe
1448	msiexec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
3912	MsiExec.exe
1920	ZoomOutlookIMPlugin.exe
1920	ZoomOutlookIMPlugin.exe
636	CptInstall.exe
636	CptInstall.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4768	msiexec.exe
Token: SeSecurityPrivilege	1448	msiexec.exe
Token: SeCreateTokenPrivilege	4768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4768	msiexec.exe
Token: SeLockMemoryPrivilege	4768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4768	msiexec.exe
Token: SeMachineAccountPrivilege	4768	msiexec.exe
Token: SeTcbPrivilege	4768	msiexec.exe
Token: SeSecurityPrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeLoadDriverPrivilege	4768	msiexec.exe
Token: SeSystemProfilePrivilege	4768	msiexec.exe
Token: SeSystemtimePrivilege	4768	msiexec.exe
Token: SeProfSingleProcessPrivilege	4768	msiexec.exe
Token: SeIncBasePriorityPrivilege	4768	msiexec.exe
Token: SeCreatePagefilePrivilege	4768	msiexec.exe
Token: SeCreatePermanentPrivilege	4768	msiexec.exe
Token: SeBackupPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeShutdownPrivilege	4768	msiexec.exe
Token: SeDebugPrivilege	4768	msiexec.exe
Token: SeAuditPrivilege	4768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4768	msiexec.exe
Token: SeChangeNotifyPrivilege	4768	msiexec.exe
Token: SeRemoteShutdownPrivilege	4768	msiexec.exe
Token: SeUndockPrivilege	4768	msiexec.exe
Token: SeSyncAgentPrivilege	4768	msiexec.exe
Token: SeEnableDelegationPrivilege	4768	msiexec.exe
Token: SeManageVolumePrivilege	4768	msiexec.exe
Token: SeImpersonatePrivilege	4768	msiexec.exe
Token: SeCreateGlobalPrivilege	4768	msiexec.exe
Token: SeBackupPrivilege	32	vssvc.exe
Token: SeRestorePrivilege	32	vssvc.exe
Token: SeAuditPrivilege	32	vssvc.exe
Token: SeBackupPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeDebugPrivilege	3912	MsiExec.exe
Token: SeRestorePrivilege	3912	MsiExec.exe
Token: SeBackupPrivilege	3912	MsiExec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe
Token: SeRestorePrivilege	1448	msiexec.exe
Token: SeTakeOwnershipPrivilege	1448	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4768	msiexec.exe
4768	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 452	4932	ZoomInstallerFull.exe	81
PID 4932 wrote to memory of 452	4932	ZoomInstallerFull.exe	81
PID 4932 wrote to memory of 4768	4932	ZoomInstallerFull.exe	82
PID 4932 wrote to memory of 4768	4932	ZoomInstallerFull.exe	82
PID 1448 wrote to memory of 616	1448	msiexec.exe	90
PID 1448 wrote to memory of 616	1448	msiexec.exe	90
PID 1448 wrote to memory of 3912	1448	msiexec.exe	95
PID 1448 wrote to memory of 3912	1448	msiexec.exe	95
PID 1448 wrote to memory of 3912	1448	msiexec.exe	95
PID 3912 wrote to memory of 1920	3912	MsiExec.exe	97
PID 3912 wrote to memory of 1920	3912	MsiExec.exe	97
PID 3912 wrote to memory of 1920	3912	MsiExec.exe	97
PID 3912 wrote to memory of 636	3912	MsiExec.exe	100
PID 3912 wrote to memory of 636	3912	MsiExec.exe	100
PID 3912 wrote to memory of 636	3912	MsiExec.exe	100

C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe
"C:\Users\Admin\AppData\Local\Temp\ZoomInstallerFull.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\WINDOWS\SYSTEM32\rundll32.exe
  C:\WINDOWS\SYSTEM32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\maker.dll, init
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Windows\SYSTEM32\msiexec.exe
  msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\ikm.msi
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:616
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 958F4B55F5C332BE23CCED5AEB203892 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe
    "C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe" /Check
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1920
- - C:\Program Files (x86)\Zoom\bin\CptInstall.exe
    "C:\Program Files (x86)\Zoom\bin\CptInstall.exe" -install -unelevate -product Zoom
    3⤵
    - Executes dropped EXE
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:636

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:32

C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe
"C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe" -user_path "C:\Users\Admin\AppData\Roaming\Zoom"
1⤵
- Executes dropped EXE
PID:3592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CptService.exe

Path C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe
Size 225KB
SHA256 0580a8af804708ed9a86d9958eecdb84845455d285fc25e5a8f618ae46f7ffab
MD5 9e5451ac860085c00d10e6e02ace93cd
SHA1 df62392329cd02d9a8b1b6b7fa694aee6ad8d7a7
SHA512 e84589fdb855cee28000e51d5be922f9cfc8901dd3099838c1d92796fdf917c24e26afc01122b9379be2f753062ccdfdc395c012d6b91d319c8b0cbc82cc5686
SSDEEP 6144:GSXbdc9YqAmzY9MsZagUyfA6x1V6rwv/JGZv1oH:G2b29Yn9MsZagUy5b6rwvhGZv1C
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptService.exe

Path C:\Program Files (x86)\Common Files\Zoom\Support\CptService.exe
Size 225KB
SHA256 0580a8af804708ed9a86d9958eecdb84845455d285fc25e5a8f618ae46f7ffab
MD5 9e5451ac860085c00d10e6e02ace93cd
SHA1 df62392329cd02d9a8b1b6b7fa694aee6ad8d7a7
SHA512 e84589fdb855cee28000e51d5be922f9cfc8901dd3099838c1d92796fdf917c24e26afc01122b9379be2f753062ccdfdc395c012d6b91d319c8b0cbc82cc5686
SSDEEP 6144:GSXbdc9YqAmzY9MsZagUyfA6x1V6rwv/JGZv1oH:G2b29Yn9MsZagUy5b6rwvhGZv1C
MD5 SHA1 SHA512 SSDEEP

Submit Download

CustomAction.dll

Path C:\Program Files (x86)\Zoom\Zoom(32bit)\CustomAction.dll
Size 463KB
SHA256 b4786fcaa00af8739df2b73922ad750d5799538448712e5933470211c230068c
MD5 cd93acb0b47d809d49de75b5e62098b9
SHA1 6cf726521daff980823667e6cb659c7ccf67085b
SHA512 832cf816d2e2713d9f1b4a805cb25b608eb02bb2fa3c001f980c70c4281c4b6456c7a5c4e492a0c3d1df106a70efe15250a8993e6c1af1c53359860082cce174
SSDEEP 12288:LwGvj46KQonIkoMTpBtjzTcLpnirkWiVeadnvq:LwGvjjKQZMpjcg2e1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CustomAction.dll

Path C:\Program Files (x86)\Zoom\Zoom(32bit)\CustomAction.dll
Size 463KB
SHA256 b4786fcaa00af8739df2b73922ad750d5799538448712e5933470211c230068c
MD5 cd93acb0b47d809d49de75b5e62098b9
SHA1 6cf726521daff980823667e6cb659c7ccf67085b
SHA512 832cf816d2e2713d9f1b4a805cb25b608eb02bb2fa3c001f980c70c4281c4b6456c7a5c4e492a0c3d1df106a70efe15250a8993e6c1af1c53359860082cce174
SSDEEP 12288:LwGvj46KQonIkoMTpBtjzTcLpnirkWiVeadnvq:LwGvjjKQZMpjcg2e1
MD5 SHA1 SHA512 SSDEEP

Submit Download

CustomAction.dll

Path C:\Program Files (x86)\Zoom\Zoom(32bit)\CustomAction.dll
Size 463KB
SHA256 b4786fcaa00af8739df2b73922ad750d5799538448712e5933470211c230068c
MD5 cd93acb0b47d809d49de75b5e62098b9
SHA1 6cf726521daff980823667e6cb659c7ccf67085b
SHA512 832cf816d2e2713d9f1b4a805cb25b608eb02bb2fa3c001f980c70c4281c4b6456c7a5c4e492a0c3d1df106a70efe15250a8993e6c1af1c53359860082cce174
SSDEEP 12288:LwGvj46KQonIkoMTpBtjzTcLpnirkWiVeadnvq:LwGvjjKQZMpjcg2e1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmmlib.dll

Path C:\Program Files (x86)\Zoom\bin\Cmmlib.dll
Size 1.6MB
SHA256 894905b29f5ca31dd0c696333fcc7e23bd3c7ba8fb758b2293df7a7f2268acf8
MD5 4fda1fc1054dab4cd2a8c61a9b98b7dc
SHA1 f52dae000279e4b30a28f3aca23b5f04654ac7c5
SHA512 09531c83673fb6a458978158016ec4daadbd6606780be7f47daa4f4b48c5a68affb63dd35797d825647c237bd218ddd50131bc4961ca59fe26318123fdd52dee
SSDEEP 24576:MI0XO3rkApkqrEKAs4EzTu26RFpAV6EQcnHa1lmad:MdO3AWdrUs44Tz6RIV6TcHa1lmad
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmmlib.dll

Path C:\Program Files (x86)\Zoom\bin\Cmmlib.dll
Size 1.6MB
SHA256 894905b29f5ca31dd0c696333fcc7e23bd3c7ba8fb758b2293df7a7f2268acf8
MD5 4fda1fc1054dab4cd2a8c61a9b98b7dc
SHA1 f52dae000279e4b30a28f3aca23b5f04654ac7c5
SHA512 09531c83673fb6a458978158016ec4daadbd6606780be7f47daa4f4b48c5a68affb63dd35797d825647c237bd218ddd50131bc4961ca59fe26318123fdd52dee
SSDEEP 24576:MI0XO3rkApkqrEKAs4EzTu26RFpAV6EQcnHa1lmad:MdO3AWdrUs44Tz6RIV6TcHa1lmad
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptControl.exe

Path C:\Program Files (x86)\Zoom\bin\CptControl.exe
Size 96KB
SHA256 8f9db23d84f8c3cfe3365a64d4aa4c87d4fa02fffa64dcc00d17c66307fc0c82
MD5 d7e39303a4d41e8f27310c2601cdb34c
SHA1 595b000756f2f6483ccaaf751f5ae3309f10e4f6
SHA512 a0088fd79630780dea041abf89e78af48ed5bd8a3976e72e89043c8a604c4d1146eb4cb35ff8206829fd2da66675652ca4bc7953301a8865a4066572f9ce2552
SSDEEP 3072:+4oyqDSXqbiC+MayMU8dVaHXzCGrozOeZWk3xQWymxA:+4rxXiiC1agIhzPZcJL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptInstall.exe

Path C:\Program Files (x86)\Zoom\bin\CptInstall.exe
Size 226KB
SHA256 1159dfd3f1a2a87efa7ed0d6fa16001695c3a0f7b21473bbf94d133ca1c41e25
MD5 c380b703ef0cb2e5bca13004a242ae65
SHA1 b52a1a3ad31688244124769f02351effc3952248
SHA512 de096b58b55f69294d68497686a76a5fca10b1fb27f087dc3216036d2a829605d6ee738eb7e346fc98e327f1398954851a4db33b71357443e657ae61e87ecc91
SSDEEP 6144:kmuXdXkTHAp2pjXor+/WiJLhdDm7FC0yBt94WSQHy:kmuXdoHDjXor+/WiR7m73yX94FQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptInstall.exe

Path C:\Program Files (x86)\Zoom\bin\CptInstall.exe
Size 226KB
SHA256 1159dfd3f1a2a87efa7ed0d6fa16001695c3a0f7b21473bbf94d133ca1c41e25
MD5 c380b703ef0cb2e5bca13004a242ae65
SHA1 b52a1a3ad31688244124769f02351effc3952248
SHA512 de096b58b55f69294d68497686a76a5fca10b1fb27f087dc3216036d2a829605d6ee738eb7e346fc98e327f1398954851a4db33b71357443e657ae61e87ecc91
SSDEEP 6144:kmuXdXkTHAp2pjXor+/WiJLhdDm7FC0yBt94WSQHy:kmuXdoHDjXor+/WiR7m73yX94FQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptService.exe

Path C:\Program Files (x86)\Zoom\bin\CptService.exe
Size 225KB
SHA256 0580a8af804708ed9a86d9958eecdb84845455d285fc25e5a8f618ae46f7ffab
MD5 9e5451ac860085c00d10e6e02ace93cd
SHA1 df62392329cd02d9a8b1b6b7fa694aee6ad8d7a7
SHA512 e84589fdb855cee28000e51d5be922f9cfc8901dd3099838c1d92796fdf917c24e26afc01122b9379be2f753062ccdfdc395c012d6b91d319c8b0cbc82cc5686
SSDEEP 6144:GSXbdc9YqAmzY9MsZagUyfA6x1V6rwv/JGZv1oH:G2b29Yn9MsZagUy5b6rwvhGZv1C
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptShare.dll

Path C:\Program Files (x86)\Zoom\bin\CptShare.dll
Size 280KB
SHA256 817d66e6ce83acf907ebf7952e72ab17e384c698998dc93d836ee7f1bd94d6e3
MD5 03c0ad10f2e76ac88586a8093111a545
SHA1 2bd73faa30fc09d1b1d036c43075da5a18f712a9
SHA512 a77d36ef13e5910d7b1e8b2a0abff97371cd1d16b7cb8818d3da1ebd5d1aa6d4b4d63b4919c2f721d42e16d8b25dab25da3b72639bae3f59a457892167ca2b5e
SSDEEP 6144:RMqhVqyt8YcjyXDAhr9auKCQaa4CN7kHrW6tfESS7JZ2l:RMqhVqyt8YmprguRCNqEf2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

CptShare.dll

Path C:\Program Files (x86)\Zoom\bin\CptShare.dll
Size 280KB
SHA256 817d66e6ce83acf907ebf7952e72ab17e384c698998dc93d836ee7f1bd94d6e3
MD5 03c0ad10f2e76ac88586a8093111a545
SHA1 2bd73faa30fc09d1b1d036c43075da5a18f712a9
SHA512 a77d36ef13e5910d7b1e8b2a0abff97371cd1d16b7cb8818d3da1ebd5d1aa6d4b4d63b4919c2f721d42e16d8b25dab25da3b72639bae3f59a457892167ca2b5e
SSDEEP 6144:RMqhVqyt8YcjyXDAhr9auKCQaa4CN7kHrW6tfESS7JZ2l:RMqhVqyt8YmprguRCNqEf2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Program Files (x86)\Zoom\bin\MSVCP140.dll
Size 440KB
SHA256 08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64
MD5 e0dd94aada0b034b212de071c33054da
SHA1 6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8
SHA512 76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2
SSDEEP 12288:1c0HQo+Oem3turAvbA2VOt4avcG9u5sldnhUgiW6QR7t5s03Ooc8dHkC2esyRs4:O0HQXm3turm9VOtTvcf03Ooc8dHkC2e/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Program Files (x86)\Zoom\bin\VCRUNTIME140.dll
Size 74KB
SHA256 49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f
MD5 87dd91c56be82866bf96ef1666f30a99
SHA1 3b78cb150110166ded8ea51fbde8ea506f72aeaf
SHA512 58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6
SSDEEP 1536:zgTqURG2vo0RwvI7sjBH+cOKXc36r23oEecbi0mju:zdURhvZ6vIQVrPypecbi0m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zoom.exe

Path C:\Program Files (x86)\Zoom\bin\Zoom.exe
Size 336KB
SHA256 306aa18dcb46b14c1d76f9c7cf78a49c88ef564b54cd4a523a1a4b5076a3ef36
MD5 260c0125fe9cae11da4cef073b077f68
SHA1 869b78d539340ba055e6810b24217021debf0fae
SHA512 d3a78b209e0cef40d35d552e32540a3a2b4d0e4683c5443a74cb1528ae5997d6c17c5413a65fd2d3b1b13c4e1c27d81c5e2bce5ce4ccc3cdb2725330607767ec
SSDEEP 3072:6CqHk5bN7e2A/QBDhz/aRGaakf0xgxr++oR/ClP9b/gLwziCMW27zy1WlxOtcWDO:Fd5bN7eSaWRaR9bYLw5ZyG1Dtc5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZoomOutlookIMPlugin.exe

Path C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe
Size 581KB
SHA256 cf8638536dd901843119c0b56cd4a61a46c3461b2d374658a713763e18389474
MD5 8ec8a4e243853dea877d12266a88cfbf
SHA1 4f6129129c0cdda57d8232a2a10d7124d06d6762
SHA512 54e50dded7c661c854a86a2b65899accc923c51e4fa44d463abdfc94e7e7412e6765b7feda81dc82fbf0eee49a08288defc56723da4ce3768f2187b887232eb1
SSDEEP 12288:dRpF/zaVnCYEx9IRr4zXBxgukYk1xoZ2vbQRiNG65Tyq:dBqTExeRr4j4bTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZoomOutlookIMPlugin.exe

Path C:\Program Files (x86)\Zoom\bin\ZoomOutlookIMPlugin.exe
Size 581KB
SHA256 cf8638536dd901843119c0b56cd4a61a46c3461b2d374658a713763e18389474
MD5 8ec8a4e243853dea877d12266a88cfbf
SHA1 4f6129129c0cdda57d8232a2a10d7124d06d6762
SHA512 54e50dded7c661c854a86a2b65899accc923c51e4fa44d463abdfc94e7e7412e6765b7feda81dc82fbf0eee49a08288defc56723da4ce3768f2187b887232eb1
SSDEEP 12288:dRpF/zaVnCYEx9IRr4zXBxgukYk1xoZ2vbQRiNG65Tyq:dBqTExeRr4j4bTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

crashrpt_lang.ini

Path C:\Program Files (x86)\Zoom\bin\crashrpt_lang.ini
Size 7KB
SHA256 1f5b45a5411f7fc71b9da789d6d1ead8ad30551fbea7bbb40fc7ea576d581abb
MD5 fcf61aed8f093bfcf571cdd8f8162a05
SHA1 8de8177798aae82d5bcc0870c1ca5365f5d9966d
SHA512 8a5d252d115f868a4e20fce10f9f9ec5f3948f0ad5680d656e0eba1fd167d36889e54c6e59bcde756945f93685401b825ba9dd7243d907d74b58a1d826609d72
SSDEEP 96:rsw6o2KPZEOTWSucfgjfJpkiZJpkiVxoVrOSBngI3NnKRFivuiLugXeTmZ4dIc83:wlo2K/uKFgVgOgnco5
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Program Files (x86)\Zoom\bin\libcrypto-1_1.dll
Size 2.5MB
SHA256 606bea4c0de0ad49486774990e3590de06d8bc6da366d6d0cb74aebf8573ffca
MD5 a97d2029f96df8bb27b22c00d84f7900
SHA1 cdbb1c2fa62f8c9ee9027335cb64a527a79b46ca
SHA512 b5353b73cb9279e62aaafa4a5912a9fe127e039bd2f07a5e23100462445e74112f40f7aa157aa6593e970dab2e85000eff386cf25f4ee84449517ca8eaa2305e
SSDEEP 49152:82pZJTwPgNZOEKvltvn481+B8nM1CPwDv3uFfJ/LaxGnD:82pZJpSlvlR481+B8M1CPwDv3uFfJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Program Files (x86)\Zoom\bin\libcrypto-1_1.dll
Size 2.5MB
SHA256 606bea4c0de0ad49486774990e3590de06d8bc6da366d6d0cb74aebf8573ffca
MD5 a97d2029f96df8bb27b22c00d84f7900
SHA1 cdbb1c2fa62f8c9ee9027335cb64a527a79b46ca
SHA512 b5353b73cb9279e62aaafa4a5912a9fe127e039bd2f07a5e23100462445e74112f40f7aa157aa6593e970dab2e85000eff386cf25f4ee84449517ca8eaa2305e
SSDEEP 49152:82pZJTwPgNZOEKvltvn481+B8nM1CPwDv3uFfJ/LaxGnD:82pZJpSlvlR481+B8M1CPwDv3uFfJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Zoom\bin\msvcp140.dll
Size 440KB
SHA256 08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64
MD5 e0dd94aada0b034b212de071c33054da
SHA1 6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8
SHA512 76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2
SSDEEP 12288:1c0HQo+Oem3turAvbA2VOt4avcG9u5sldnhUgiW6QR7t5s03Ooc8dHkC2esyRs4:O0HQXm3turm9VOtTvcf03Ooc8dHkC2e/
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\Program Files (x86)\Zoom\bin\msvcp140.dll
Size 440KB
SHA256 08442853f19ce4ff3acae37d87eab33ef81c4c6da62a3432d43253ba79842b64
MD5 e0dd94aada0b034b212de071c33054da
SHA1 6c4f1b3f66d07bbcdcf41eb39b1480bb335efcc8
SHA512 76c877056f448e5dab820e990cc186ba886b2d331d689a99295aaff31a63aadb941c2693b0be98d53bd06cd8041a270eb82ddedfbde305cd9a85bcbe42fcf5a2
SSDEEP 12288:1c0HQo+Oem3turAvbA2VOt4avcG9u5sldnhUgiW6QR7t5s03Ooc8dHkC2esyRs4:O0HQXm3turm9VOtTvcf03Ooc8dHkC2e/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Program Files (x86)\Zoom\bin\ucrtbase.dll
Size 1.1MB
SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
MD5 2040cdcd779bbebad36d36035c675d99
SHA1 918bc19f55e656f6d6b1e4713604483eb997ea15
SHA512 83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
SSDEEP 24576:tCjjeiNFnAp+O+R2l2WDPc/9qHrX0cJ/gAp0ei5mcvIZPoy4aVvFjDp:4jyuRR2l2WD6I/bp0erVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Program Files (x86)\Zoom\bin\ucrtbase.dll
Size 1.1MB
SHA256 2ad9a105a9caa24f41e7b1a6f303c07e6faeceaf3aaf43ebd644d9d5746a4359
MD5 2040cdcd779bbebad36d36035c675d99
SHA1 918bc19f55e656f6d6b1e4713604483eb997ea15
SHA512 83dc3c7e35f0f83e1224505d04cdbaee12b7ea37a2c3367cb4fccc4fff3e5923cf8a79dd513c33a667d8231b1cc6cfb1e33f957d92e195892060a22f53c7532f
SSDEEP 24576:tCjjeiNFnAp+O+R2l2WDPc/9qHrX0cJ/gAp0ei5mcvIZPoy4aVvFjDp:4jyuRR2l2WD6I/bp0erVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Zoom\bin\vcruntime140.dll
Size 74KB
SHA256 49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f
MD5 87dd91c56be82866bf96ef1666f30a99
SHA1 3b78cb150110166ded8ea51fbde8ea506f72aeaf
SHA512 58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6
SSDEEP 1536:zgTqURG2vo0RwvI7sjBH+cOKXc36r23oEecbi0mju:zdURhvZ6vIQVrPypecbi0m
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Zoom\bin\vcruntime140.dll
Size 74KB
SHA256 49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f
MD5 87dd91c56be82866bf96ef1666f30a99
SHA1 3b78cb150110166ded8ea51fbde8ea506f72aeaf
SHA512 58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6
SSDEEP 1536:zgTqURG2vo0RwvI7sjBH+cOKXc36r23oEecbi0mju:zdURhvZ6vIQVrPypecbi0m
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\Zoom\bin\vcruntime140.dll
Size 74KB
SHA256 49b0fd1751342c253cac588dda82ec08e4ef43cebc5a9d80deb7928109b90c4f
MD5 87dd91c56be82866bf96ef1666f30a99
SHA1 3b78cb150110166ded8ea51fbde8ea506f72aeaf
SHA512 58c3ec6761624d14c7c897d8d0842dbeab200d445b4339905dac8a3635d174cdfb7b237d338d2829bc6c602c47503120af5be0c7de6abf2e71c81726285e44d6
SSDEEP 1536:zgTqURG2vo0RwvI7sjBH+cOKXc36r23oEecbi0mju:zdURhvZ6vIQVrPypecbi0m
MD5 SHA1 SHA512 SSDEEP

Submit Download

zCrashReport.dll

Path C:\Program Files (x86)\Zoom\bin\zCrashReport.dll
Size 97KB
SHA256 aab43f8a9ab37b205e651ac629404ee8dbbc9bf0b4fee85b422275406a1c2572
MD5 f82f0a3932e73d4f6973632d42c0f296
SHA1 9a59389cc938121a5941a589fc4b66a7d65af7e3
SHA512 97a098112f448362bd677f2991243b8b024d37f03adf7facdb0601639bc0fb9ca99945bc08d8eca580903120c0a6de7a35106984500207a3c5562a34dbc37ea9
SSDEEP 1536:0w4UPMx7wDUTiVmo5W6Jow0OiY1mT0I00dAWG3PxbWGAPxN:XsCUTem6ow0OiYkTl00mWMxbWJxN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zCrashReport.dll

Path C:\Program Files (x86)\Zoom\bin\zCrashReport.dll
Size 97KB
SHA256 aab43f8a9ab37b205e651ac629404ee8dbbc9bf0b4fee85b422275406a1c2572
MD5 f82f0a3932e73d4f6973632d42c0f296
SHA1 9a59389cc938121a5941a589fc4b66a7d65af7e3
SHA512 97a098112f448362bd677f2991243b8b024d37f03adf7facdb0601639bc0fb9ca99945bc08d8eca580903120c0a6de7a35106984500207a3c5562a34dbc37ea9
SSDEEP 1536:0w4UPMx7wDUTiVmo5W6Jow0OiY1mT0I00dAWG3PxbWGAPxN:XsCUTem6ow0OiYkTl00mWMxbWJxN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zCrashReport.dll

Path C:\Program Files (x86)\Zoom\bin\zCrashReport.dll
Size 97KB
SHA256 aab43f8a9ab37b205e651ac629404ee8dbbc9bf0b4fee85b422275406a1c2572
MD5 f82f0a3932e73d4f6973632d42c0f296
SHA1 9a59389cc938121a5941a589fc4b66a7d65af7e3
SHA512 97a098112f448362bd677f2991243b8b024d37f03adf7facdb0601639bc0fb9ca99945bc08d8eca580903120c0a6de7a35106984500207a3c5562a34dbc37ea9
SSDEEP 1536:0w4UPMx7wDUTiVmo5W6Jow0OiY1mT0I00dAWG3PxbWGAPxN:XsCUTem6ow0OiYkTl00mWMxbWJxN
MD5 SHA1 SHA512 SSDEEP

Submit Download

zCrashReport.exe

Path C:\Program Files (x86)\Zoom\bin\zCrashReport.exe
Size 219KB
SHA256 52089b799c309f023b8d58b703302c3165bc4c680ea8135cb18d7fabc0d42c1c
MD5 97042fb62a7ef502dcd1bc96bc490e28
SHA1 1d1f822fe6095660c9bcae225d110298ab3be32e
SHA512 916a1f34871aec9433605bb8a3b208018df30d0e5fdbb935566793523b5b9281d7ac4c1a94932541267a0b4bdb3b71a1f389ce48f7e5a90838d58fd351921bd1
SSDEEP 3072:wIpSfpo+81kQO+xTFQd1NnfYH6Oimtl6WvxNWixLK:wIpSm+YFQd11A6OixqjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

zOutlookIMUtil.dll

Path C:\Program Files (x86)\Zoom\bin\zOutlookIMUtil.dll
Size 474KB
SHA256 a81057faa8bd295d0708a34c1879ad5abd4a46ac82a322b7027c027de0439451
MD5 6934de614ca4dd452966e086bea3ead0
SHA1 7c5ca8e69cd685dffa4537285ec601bc760e11c9
SHA512 2ddee6238212d190ccfe4cd06c5a77c9c5c956e6a8f733a1781ace2f4db3457a2e38295aba6469a2e8e12957fb435fcb514de5f4516fb2dcbd005f58bd4d9d60
SSDEEP 6144:4eppdpdihuRgo6OGqQe+E3JV4Lb0pil69RHo+0BJmtrQE8NOpWCrWoq09FTFBAXS:44HGqp+SgirCJ8qRhW
MD5 SHA1 SHA512 SSDEEP

Submit Download

emojione_low.7z

Path C:\Program Files (x86)\Zoom\resources\emojione_low.7z
Size 7.4MB
SHA256 ed3419d21d69fd71d2133bfcf83732215f4c65eb547ef73107cb98d03e86cd2f
MD5 4d4920bf542c67be8e85249faf9bb89e
SHA1 3ae7e5ae51179056c61487902534336c1996a807
SHA512 402e878f8976cc4c59264ad5ece9bd8a6c6d371103626d6d0f65b55a0d6139eaa1f0a74c1f63149d158de267467b3cd124038d9447808646a8350736a5e9bc9d
SSDEEP 196608:wkZDozTVugIZK9dpEyh5z1TB/lvnqVQmVPlK3CAFz:w+QhIs9dp5hTZlvnqumte
MD5 SHA1 SHA512 SSDEEP

Submit Download

2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Size 471B
SHA256 87ce84485e6f921197e3311daf148409467c4c22de5be0262dec335db99dd3d2
MD5 3d6d32201068dec616e1647b13fb20a0
SHA1 1ba356cd257b3a29e7360ed524418017aeb236fd
SHA512 4fde7ddcd031cb33cae430f0eb1642057e7add5a7b2cedb37a3d14fd236438e5017c6cc956c9c1e1e3f7c8058de8d66dc4ba7a766dae344ccf9b5c54876c21e7
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 79ac574c7c45144bb35b59ff79c78dc59b66592715dea01b389e3620db663224
MD5 da5a9f149955d936a31dc5e456666aac
SHA1 195238d41c1e13448f349f43bb295ef2d55cb47a
SHA512 60d7d1f5405470ba1e6b80066af2e78240acbea8db58b5a03660874605178aebaa9ce342ca97f17798109e7411e82466db5af064e39eaddc05410f2abe672f77
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4
Size 727B
SHA256 88aa0368e6cef4039aa08ca54a25b64de12fed4ea4bda524abe63700b35a18a0
MD5 64ef8de7f763b3561ec8fed1b72bb33d
SHA1 d37fa6a297698c0a09adcad9db7a54e62dab70e3
SHA512 ababf6619fe411f28704cf6e4723f5defe0f1dd66fdb95b96abb777256a1f127dbe74a079b95b11673523197ed09f8c04cecf8cf1d7ed85276a409ffb6ed3411
MD5 SHA1 SHA512

Submit Download

D9CB7DFFEEA63BAB482BD2705E7E24AB_C5076ACD41E9D9741BBEE5F165E53636

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CB7DFFEEA63BAB482BD2705E7E24AB_C5076ACD41E9D9741BBEE5F165E53636
Size 727B
SHA256 66a252e9cf003a10ebd3b2d246c9bd76f9a88c3d99841c5fcc4a565614f9bca5
MD5 a474be24c3cb3f3cd2054d3d3dad75df
SHA1 cd1d1f7f6301d66d5819959e2b30822b7b06f129
SHA512 8a41f1a6c7b997a2a60638496214ad548a7a4965ef0b871bae3023237f77dab4de5023e1e5186dd0b092bc4f30363ff6da0b2cf07ab452ce87efd48c31e3b380
MD5 SHA1 SHA512

Submit Download

2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Size 430B
SHA256 896780f7da09579251d45e5a8b0f49bae1da80dd1755f68290bd17eab4155bab
MD5 90c1a8faef4d08b6a07c0a6f5fa7c495
SHA1 aaf15089838221d68f034654cf534c55d6606874
SHA512 045f0c519dabfe7ea535e7ec240265626b1275966a2fc42ff43f4b65e206c312321b211a12ddb2e9fbe8d30787ad80cd7198581d74288309b7f18f26c2b22b35
MD5 SHA1 SHA512

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 430B
SHA256 844d39915e3e14c12bfc0aa930028bc0f04fcbb4545038f39b1e3e4e01a9b8da
MD5 138622aaf0093237956e49d9f65ba811
SHA1 56a53987438cb770e76c0fddc0fce7f2980fe73e
SHA512 1009c3f2727665feb68e3c72e0556648b520242a9888dae6f5a5a25b8386b0eb699e4dae755f7ffd2e30d0ea8db0fe4ffcfa054b571d54cb8d0a40db620537d0
MD5 SHA1 SHA512

Submit Download

C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_8DBAD5A433D1F9275321E076E8B744D4
Size 446B
SHA256 914f176c7118ab5189dedbeb2403e5fb07763ee4d2ae73b1aaddb43e4abae6ce
MD5 c4d835155883792df09eaa3997f071ed
SHA1 821a8664c560b7bbbac748df06d3151bfc007015
SHA512 118b185c237cc45f741ae359b3c052f8eddadd22a4065305ed68aa74bbabc0ed75cb1fba1fd8629a2230d3990d61dc8882257b393492836e139e9d2e7c0edd07
MD5 SHA1 SHA512

Submit Download

D9CB7DFFEEA63BAB482BD2705E7E24AB_C5076ACD41E9D9741BBEE5F165E53636

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D9CB7DFFEEA63BAB482BD2705E7E24AB_C5076ACD41E9D9741BBEE5F165E53636
Size 408B
SHA256 6b4d779f7a97dd32c36da427b826de6d1e48e66b056a45c0fe82f83df1b922c3
MD5 2bfe2f5ace6e7c9ec5d9a5da293cd998
SHA1 b080c13244df9cd43660808090e54038c9ffa424
SHA512 405427f628dc2e7b2fe918e47fa7b8e4fea1456e6e1b6caf1c601eab8ceb275c9edf0967ec651e997bb26654372224c026557d6e715a3a690ca1c460b7341371
MD5 SHA1 SHA512

Submit Download

ikm.msi

Path C:\Users\Admin\AppData\Local\Temp\ikm.msi
Size 75.1MB
SHA256 839c1a8a906bd0bce47262a904708ed58eb832a1acae917ecd758ab5a01f3234
MD5 f7f764ed7be9356b85c73462542b36c3
SHA1 e0a67fa1d899d464ec6a268dcfb1b14de172c582
SHA512 fafa807291c19bac4da510edc5ccea607b77b0220c5c9090d1eb5a7c3a022f67c113bdf51ef13bc6af830ae3843ca4ea53d96a033fc5aae9714a8708e068b45c
SSDEEP 1572864:YpDrQefrQSB+gTC4GB3RA9MLhWG7VYlSGTbANByfGajuTgIrPJGs:ODLfrQQ/FA3RAicfUjByfFIDJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

maker.dll

Path C:\Users\Admin\AppData\Local\Temp\maker.dll
Size 1.3MB
SHA256 3c9cd4cf008ed70df41cc270c77055f6edac139ec7ec2a9c3de1b21c1a294ca7
MD5 c97d41e563c07d771cd661533ad4ede7
SHA1 739ec4cca4ca4204848798c39092d507f0902895
SHA512 f3f764be1e1080de02f443c17ddfa1c90750b77e2852dee9dc0dac35bf8a53dd13576a02dc8d0abb0eed04c0fd4702b8e62be4dc214ba2e58dbc55b25f72351d
SSDEEP 24576:4wkH3QY3UZp/g+/GomPS06uYOW+EzI7L/Cge89YiJh23NFEi7:45AMUHsJ6uYOWnzGi89RJh2dFEi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

maker.dll

Path C:\Users\Admin\AppData\Local\Temp\maker.dll
Size 1.3MB
SHA256 3c9cd4cf008ed70df41cc270c77055f6edac139ec7ec2a9c3de1b21c1a294ca7
MD5 c97d41e563c07d771cd661533ad4ede7
SHA1 739ec4cca4ca4204848798c39092d507f0902895
SHA512 f3f764be1e1080de02f443c17ddfa1c90750b77e2852dee9dc0dac35bf8a53dd13576a02dc8d0abb0eed04c0fd4702b8e62be4dc214ba2e58dbc55b25f72351d
SSDEEP 24576:4wkH3QY3UZp/g+/GomPS06uYOW+EzI7L/Cge89YiJh23NFEi7:45AMUHsJ6uYOWnzGi89RJh2dFEi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 23.0MB
SHA256 5995d9574d176c790e37eaaff01784f4494764742a52aecae1da54f600882f6c
MD5 61d5f0bee83c0552095cf61f245bfc3b
SHA1 49b1be9f307ae13d8685698405104de10c4f9bd1
SHA512 6cbbe4ee327858f029226686534b54fd7180710030a5e547a5aaba8c7791a39fbb71bbf17ee6e687f5daf07144b010c7c78d0c2b7ec09f4cc3cf8751f782fac7
SSDEEP 24576:TjdmOnIqdoO/vvTL2rGuo1LLwhkLEvwzkhAdEQCArdq7X+uGoTPddv8MP:z
MD5 SHA1 SHA512 SSDEEP

Submit Download

{5bd164d2-5983-49f3-a26f-233c25fae59f}_OnDiskSnapshotProp

Path \??\Volume{d2609e0b-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5bd164d2-5983-49f3-a26f-233c25fae59f}_OnDiskSnapshotProp
Size 5KB
SHA256 d53d4af8224d42bd192d780ad7158f6517ffa631425d7c783779874716a811ee
MD5 22649bfd8e4535ac17cd82883e97fb57
SHA1 ee825ca0d8682d3be1e0d9a4c7f078834f2fbd63
SHA512 b9363b373081dd18aec5a6d52b46deaa265f5931489a94f591f810d24e26e2fc52cf7c4ce2978bd233ee7c69df7f63abedb346d6118281421fc6d3fd5ed57b61
SSDEEP 96:FYobn+lh3qDD84LTHzbOHXOHBlBRQn8Sa9XE56tRSVQEJ:qllsb++CzJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/452-135-0x0000000180000000-0x0000000180009000-memory.dmp

Download