b74ba6428b26229a69915b76a7cda7ea9905b46b934caa4e1349175e173ef50c

General

Target
ZhumuInstaller.exe
Size 1.4MB
Sample260421-e8m19ahx2q
SHA256 b74ba6428b26229a69915b76a7cda7ea9905b46b934caa4e1349175e173ef50c
MD5 ded9fb3983074d02bd45fdd5101246f4
SHA1 aa8e98c900cc94b7b47f24934fc5485b97f7e2a9
SHA512 38bcfa35eab77b911d72c44023c55be1ced7d57f2d11cc78d051fedf891d6493e3812b9b597cafd1da8c0a7e7fb298cbf56e6c16ca1de5990996806780f64e6f
SSDEEP 24576:TnChUwWjyNFHl9rpMrimsbLWvGsrAhTDuOBv:xINFrp5bCvtAhTDuev
TLSH
T1DE655B01E1216127EC6244B69AFB157DA8256E64170441C3B2DCFB7A8B76FE3AC33727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	3376	ZhumuInstaller.exe

Executes dropped EXE 1 IoCs

pid	Process
2472	Zhumu.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4768	sc.exe

Loads dropped DLL 2 IoCs

pid	Process
2472	Zhumu.exe
2472	Zhumu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZhumuInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zhumu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2240	MsiExec.exe
Token: SeIncreaseQuotaPrivilege	2240	MsiExec.exe
Token: SeSecurityPrivilege	4208	msiexec.exe
Token: SeCreateTokenPrivilege	2240	MsiExec.exe
Token: SeAssignPrimaryTokenPrivilege	2240	MsiExec.exe
Token: SeLockMemoryPrivilege	2240	MsiExec.exe
Token: SeIncreaseQuotaPrivilege	2240	MsiExec.exe
Token: SeMachineAccountPrivilege	2240	MsiExec.exe
Token: SeTcbPrivilege	2240	MsiExec.exe
Token: SeSecurityPrivilege	2240	MsiExec.exe
Token: SeTakeOwnershipPrivilege	2240	MsiExec.exe
Token: SeLoadDriverPrivilege	2240	MsiExec.exe
Token: SeSystemProfilePrivilege	2240	MsiExec.exe
Token: SeSystemtimePrivilege	2240	MsiExec.exe
Token: SeProfSingleProcessPrivilege	2240	MsiExec.exe
Token: SeIncBasePriorityPrivilege	2240	MsiExec.exe
Token: SeCreatePagefilePrivilege	2240	MsiExec.exe
Token: SeCreatePermanentPrivilege	2240	MsiExec.exe
Token: SeBackupPrivilege	2240	MsiExec.exe
Token: SeRestorePrivilege	2240	MsiExec.exe
Token: SeShutdownPrivilege	2240	MsiExec.exe
Token: SeDebugPrivilege	2240	MsiExec.exe
Token: SeAuditPrivilege	2240	MsiExec.exe
Token: SeSystemEnvironmentPrivilege	2240	MsiExec.exe
Token: SeChangeNotifyPrivilege	2240	MsiExec.exe
Token: SeRemoteShutdownPrivilege	2240	MsiExec.exe
Token: SeUndockPrivilege	2240	MsiExec.exe
Token: SeSyncAgentPrivilege	2240	MsiExec.exe
Token: SeEnableDelegationPrivilege	2240	MsiExec.exe
Token: SeManageVolumePrivilege	2240	MsiExec.exe
Token: SeImpersonatePrivilege	2240	MsiExec.exe
Token: SeCreateGlobalPrivilege	2240	MsiExec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2240	MsiExec.exe
2240	MsiExec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 4728	3376	ZhumuInstaller.exe	79
PID 4728 wrote to memory of 4996	4728	cmd.exe	81
PID 4996 wrote to memory of 4892	4996	net.exe	82
PID 3376 wrote to memory of 3680	3376	ZhumuInstaller.exe	83
PID 3680 wrote to memory of 4768	3680	cmd.exe	85
PID 3376 wrote to memory of 2472	3376	ZhumuInstaller.exe	86
PID 2472 wrote to memory of 2240	2472	Zhumu.exe	87

C:\Users\Admin\AppData\Local\Temp\ZhumuInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\ZhumuInstaller.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop ZoomCptService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\net.exe
    net stop ZoomCptService
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop ZoomCptService
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c sc delete ZoomCptService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\sc.exe
    sc delete ZoomCptService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4768
- C:\Users\Admin\AppData\Roaming\Zhumu Cloud Meetings\Zhumu.exe
  "C:\Users\Admin\AppData\Roaming\Zhumu Cloud Meetings\Zhumu.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\MsiExec.exe
    MsiExec.exe /x {D65EABCB-A6B8-4B60-88F5-A1BAA43A202F} /passive
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2240

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso81FD.tmp\System.dll
Size 11KB
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
TLSH
T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsNiuniuSkin.dll

Path C:\Users\Admin\AppData\Local\Temp\nso81FD.tmp\nsNiuniuSkin.dll
Size 904KB
SHA256 f125ed6489f16f1681ea92e30f6670f72e0951cd7948df9a043e04ee512ccbeb
MD5 00b5a327b44faaaf7fc373176cd454ed
SHA1 e58ea8e7de259f5d577c01eeac28cc8f72b65094
SHA512 a7c5955652e1dd6f33e6596f0861a2127e4a259ae7abd256a44b3ffc36c1861e29fe3e9a2b60aa5a0230430411c737ef2b2e9170e4f0f42f737039451326340a
SSDEEP 12288:QNeAvlyBkh+B3FAxDG6+zAC1yHbmf4gb7T+C9mOyCcMUubex/AP1fg6uH8h:QNehrB1ABGfGSfJbH+CVUP4fRo8h
TLSH
T104155C11DA81A136EEFB04F2497F66BD9528BA31131450C763C4AEAE8B359F17E31327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

skin.zip

Path C:\Users\Admin\AppData\Local\Temp\nso81FD.tmp\skin.zip
Size 2.1MB
SHA256 f11381035b4246e4f03cf0b3913856708556ffedac930372e7d5c33f0090109f
MD5 12f6b2b48ccd026a924b7a8529e46cf6
SHA1 6f5f5c10e0e387127f122b918c96b9baf0e7ea49
SHA512 e86516fee41a0d22f61ec5bebcd3ea37fecd66f35eb716ec896d233cf524eed4f6a4b0c73c6ac9c6df293ce05686b577d1b6fa5fd8c223d6d9ba41e9990cb753
SSDEEP 49152:4SEfldDWBMlRVC9fSr7qHhBtULnAviH2eJk1e2aXyQcrf/MDg6eJk1+z3:4SEfldDWBORVCkSHhBtULnAC2eJkYXSl
TLSH
T157A5335881843E7BC80E6B7F7D4F972FD4B35FC951A906A860DE485FC68FE401A1A983
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2240-37-0x0000000001210000-0x000000000125A000-memory.dmp

Download

memory/2472-46-0x00000000022F0000-0x000000000233A000-memory.dmp

Download

memory/3376-0-0x0000000000A90000-0x0000000000ADA000-memory.dmp

Download

memory/3376-13-0x0000000000A90000-0x0000000000ADA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads