b74ba6428b26229a69915b76a7cda7ea9905b46b934caa4e1349175e173ef50c

General

Target
ZhumuInstaller.exe
Size 1.4MB
Sample260421-e8m19ahx2q
SHA256 b74ba6428b26229a69915b76a7cda7ea9905b46b934caa4e1349175e173ef50c
MD5 ded9fb3983074d02bd45fdd5101246f4
SHA1 aa8e98c900cc94b7b47f24934fc5485b97f7e2a9
SHA512 38bcfa35eab77b911d72c44023c55be1ced7d57f2d11cc78d051fedf891d6493e3812b9b597cafd1da8c0a7e7fb298cbf56e6c16ca1de5990996806780f64e6f
SSDEEP 24576:TnChUwWjyNFHl9rpMrimsbLWvGsrAhTDuOBv:xINFrp5bCvtAhTDuev
TLSH
T1DE655B01E1216127EC6244B69AFB157DA8256E64170441C3B2DCFB7A8B76FE3AC33727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	1888	ZhumuInstaller.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	ZhumuInstaller.exe

Executes dropped EXE 1 IoCs

pid	Process
2416	Zhumu.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3508	sc.exe

Loads dropped DLL 2 IoCs

pid	Process
2416	Zhumu.exe
2416	Zhumu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zhumu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhumuInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5060	MsiExec.exe
Token: SeIncreaseQuotaPrivilege	5060	MsiExec.exe
Token: SeSecurityPrivilege	2088	msiexec.exe
Token: SeCreateTokenPrivilege	5060	MsiExec.exe
Token: SeAssignPrimaryTokenPrivilege	5060	MsiExec.exe
Token: SeLockMemoryPrivilege	5060	MsiExec.exe
Token: SeIncreaseQuotaPrivilege	5060	MsiExec.exe
Token: SeMachineAccountPrivilege	5060	MsiExec.exe
Token: SeTcbPrivilege	5060	MsiExec.exe
Token: SeSecurityPrivilege	5060	MsiExec.exe
Token: SeTakeOwnershipPrivilege	5060	MsiExec.exe
Token: SeLoadDriverPrivilege	5060	MsiExec.exe
Token: SeSystemProfilePrivilege	5060	MsiExec.exe
Token: SeSystemtimePrivilege	5060	MsiExec.exe
Token: SeProfSingleProcessPrivilege	5060	MsiExec.exe
Token: SeIncBasePriorityPrivilege	5060	MsiExec.exe
Token: SeCreatePagefilePrivilege	5060	MsiExec.exe
Token: SeCreatePermanentPrivilege	5060	MsiExec.exe
Token: SeBackupPrivilege	5060	MsiExec.exe
Token: SeRestorePrivilege	5060	MsiExec.exe
Token: SeShutdownPrivilege	5060	MsiExec.exe
Token: SeDebugPrivilege	5060	MsiExec.exe
Token: SeAuditPrivilege	5060	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	5060	MsiExec.exe
Token: SeChangeNotifyPrivilege	5060	MsiExec.exe
Token: SeRemoteShutdownPrivilege	5060	MsiExec.exe
Token: SeUndockPrivilege	5060	MsiExec.exe
Token: SeSyncAgentPrivilege	5060	MsiExec.exe
Token: SeEnableDelegationPrivilege	5060	MsiExec.exe
Token: SeManageVolumePrivilege	5060	MsiExec.exe
Token: SeImpersonatePrivilege	5060	MsiExec.exe
Token: SeCreateGlobalPrivilege	5060	MsiExec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5060	MsiExec.exe
5060	MsiExec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4052	1888	ZhumuInstaller.exe	85
PID 4052 wrote to memory of 2716	4052	cmd.exe	87
PID 2716 wrote to memory of 1912	2716	net.exe	88
PID 1888 wrote to memory of 4584	1888	ZhumuInstaller.exe	89
PID 4584 wrote to memory of 3508	4584	cmd.exe	91
PID 1888 wrote to memory of 2416	1888	ZhumuInstaller.exe	92
PID 2416 wrote to memory of 5060	2416	Zhumu.exe	94

C:\Users\Admin\AppData\Local\Temp\ZhumuInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ZhumuInstaller.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ZoomCptService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\net.exe
    net stop ZoomCptService
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ZoomCptService
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc delete ZoomCptService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\sc.exe
    sc delete ZoomCptService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3508
- C:\Users\Admin\AppData\Roaming\Zhumu Cloud Meetings\Zhumu.exe
  "C:\Users\Admin\AppData\Roaming\Zhumu Cloud Meetings\Zhumu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\MsiExec.exe
    MsiExec.exe /x {D65EABCB-A6B8-4B60-88F5-A1BAA43A202F} /passive
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa8633.tmp\System.dll
Size 11KB
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
TLSH
T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nsa8633.tmp\nsNiuniuSkin.dll
Size 904KB
SHA256 f125ed6489f16f1681ea92e30f6670f72e0951cd7948df9a043e04ee512ccbeb
MD5 00b5a327b44faaaf7fc373176cd454ed
SHA1 e58ea8e7de259f5d577c01eeac28cc8f72b65094
SHA512 a7c5955652e1dd6f33e6596f0861a2127e4a259ae7abd256a44b3ffc36c1861e29fe3e9a2b60aa5a0230430411c737ef2b2e9170e4f0f42f737039451326340a
SSDEEP 12288:QNeAvlyBkh+B3FAxDG6+zAC1yHbmf4gb7T+C9mOyCcMUubex/AP1fg6uH8h:QNehrB1ABGfGSfJbH+CVUP4fRo8h
TLSH
T104155C11DA81A136EEFB04F2497F66BD9528BA31131450C763C4AEAE8B359F17E31327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nsa8633.tmp\skin.zip
Size 2.1MB
SHA256 f11381035b4246e4f03cf0b3913856708556ffedac930372e7d5c33f0090109f
MD5 12f6b2b48ccd026a924b7a8529e46cf6
SHA1 6f5f5c10e0e387127f122b918c96b9baf0e7ea49
SHA512 e86516fee41a0d22f61ec5bebcd3ea37fecd66f35eb716ec896d233cf524eed4f6a4b0c73c6ac9c6df293ce05686b577d1b6fa5fd8c223d6d9ba41e9990cb753
SSDEEP 49152:4SEfldDWBMlRVC9fSr7qHhBtULnAviH2eJk1e2aXyQcrf/MDg6eJk1+z3:4SEfldDWBORVCkSHhBtULnAC2eJkYXSl
TLSH
T157A5335881843E7BC80E6B7F7D4F972FD4B35FC951A906A860DE485FC68FE401A1A983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-0-0x0000000001500000-0x0000000001781000-memory.dmp

Download

memory/1888-13-0x0000000001500000-0x0000000001781000-memory.dmp

Download

memory/2416-46-0x00000000008F0000-0x0000000000B71000-memory.dmp

Download

memory/2416-53-0x00000000008F0000-0x0000000000B71000-memory.dmp

Download

memory/5060-37-0x00000000006D0000-0x0000000000951000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads