Overview

overview

6

Static

static

1

Feishu-win...ed.exe

windows10-2004-x64

1

Feishu-win...ed.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    123s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Feishu-win32_x64-7.68.6-signed.exe
  • Size 352.6MB
  • Sample260629-e5kfysc14y
  • SHA256 23a5fd5ea49a60d6470c00f4cae9ddb459d5cdbc49a786486654e952b69254b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:6068
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:252
  • C:\Users\Admin\AppData\Local\Temp\Feishu-win32_x64-7.68.6-signed.exe
    "C:\Users\Admin\AppData\Local\Temp\Feishu-win32_x64-7.68.6-signed.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:2936
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1524
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        copy.vert
        • Path C:\Users\Admin\AppData\Local\Feishu\app\RTCSDK_RES\effect\matting_bg\AmazingFeature\xshader\copy.vert
        • Size 170B
        • SHA256 11f6adf2fd0fcb6bdf75b6d8a76b2bea20c51422560bad4a9f612139c3439e31
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GlobalSign_cert.der
        • Path C:\Users\Admin\AppData\Local\Feishu\app\aha_doctor\config\certs\Globbalsign_ECC_GlobalSign ECC Root CA - R5\GlobalSign_cert.der
        • Size 867B
        • SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        contract_pushed.svg
        • Path C:\Users\Admin\AppData\Local\Feishu\app\aha_doctor\resources\themes\public\button\contract_pushed.svg
        • Size 263B
        • SHA256 b2318c8714c3c2ffc327df67eddd6df0d41368b9082b657f9fb9d1d5a677ec2b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        expand_left_pushed.svg
        • Path C:\Users\Admin\AppData\Local\Feishu\app\aha_doctor\resources\themes\public\button\expand_left_pushed.svg
        • Size 262B
        • SHA256 2ec930a140e7a74b4f287e46dd2b183bdc2670846790dd55d8c6ef3a390ce23b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        expand_right_pushed.svg
        • Path C:\Users\Admin\AppData\Local\Feishu\app\aha_doctor\resources\themes\public\button\expand_right_pushed.svg
        • Size 234B
        • SHA256 aab9e3eb03e72b11c94bacbbee77acd1d3f03f32c7aa9e99c9004569b0fd0d1b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        algorithmConfig.json
        • Path C:\Users\Admin\AppData\Local\Feishu\app\vesdk\effects\roundrect_border\AmazingFeature_2998\algorithmConfig.json
        • Size 410B
        • SHA256 5eb7116211717163a3f9ffc78a157fa3a2e28a25052e5d4d7ef6da671029e16f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lua-meta.json
        • Path C:\Users\Admin\AppData\Local\Feishu\app\vesdk\effects\roundrect_border\AmazingFeature_2998\lua-meta.json
        • Size 2B
        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
        • MD5 SHA1 SHA512
        Submit Download

        border.vert
        • Path C:\Users\Admin\AppData\Local\Feishu\app\vesdk\effects\roundrect_border\AmazingFeature_2998\xshader\border.vert
        • Size 182B
        • SHA256 54398dcfc26f5079254a3cfd48b71db52dc2e9c133607f9e98f32a231eeee69f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        es-ES.html
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\bitable\es-ES.html
        • Size 39KB
        • SHA256 97588e88e5aee1faf5e2bd91818bb41f31f2547d7ac223d52e23a2a4f3573d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8085-de-DE.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-de-DE.js
        • Size 202B
        • SHA256 85906d61f7aa421b7182bcad2f0fda07383a3a2a1970a23cc360d351e81221ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-en-US.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-en-US.js
        • Size 195B
        • SHA256 da83be065b6e24980da02981f8337fbd8215e7c5cc4366c7fc1a6402a52ef1cf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-es-ES.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-es-ES.js
        • Size 199B
        • SHA256 83180a1fd70e8bd48150354bb33221aec68e58cef1b08966460d7eac8247785d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-fr-FR.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-fr-FR.js
        • Size 198B
        • SHA256 f899a07e3105515190fa62100b6191d2af8c5183edb414c1700ee4c44c7c1fa9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-id-ID.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-id-ID.js
        • Size 197B
        • SHA256 30baa04df5100c98e8e769e23038bb65bed25d20ac9b9d8b1fa16e6b94f7fead
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-it-IT.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-it-IT.js
        • Size 197B
        • SHA256 a164e9c3e10719efca958e92a74e3fc9e757f7d4b30f7673db087011a5a0a516
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-ja-JP.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-ja-JP.js
        • Size 203B
        • SHA256 42f44b3df11217114c28a5563b6bf8ed00d554d222fc990930b89e2d891071f1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-ko-KR.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-ko-KR.js
        • Size 194B
        • SHA256 bc82c325f58c049fca76bdda384eec6183383556eb4983f5f92008d59a8ef5a5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-ms-MY.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-ms-MY.js
        • Size 193B
        • SHA256 555720e1d2a3a1bbf240fd5fec6fb1d7c536152484b62dd7b008746168695124
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-pt-BR.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-pt-BR.js
        • Size 199B
        • SHA256 b65ac81899387651f6ca04eb93dd0c1c9ec3334ead03db0900c6b9c9a45e0276
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-ru-RU.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-ru-RU.js
        • Size 216B
        • SHA256 5d6546c1123f0944a02dc06c3fdccddf1c1ba770c390dd16c83c17be19805587
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-th-TH.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-th-TH.js
        • Size 218B
        • SHA256 da4877bd7b292250ec8661cb844aadcb9281d90c2acaaf9eb5982498e7eb43dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-vi-VN.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-vi-VN.js
        • Size 198B
        • SHA256 89dca1f884919c573fabdcff20e5ca4b235fcb37c0f5cc37b343837b29a7ecdf
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-zh-CN.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-zh-CN.js
        • Size 194B
        • SHA256 58355b836b89fae3bb8031b88ce64794c80943d4f720d07aa4b24398cc18e67e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-zh-HK.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-zh-HK.js
        • Size 194B
        • SHA256 3eb0013a75bf2e7b5791b8b91736c9794dca4fdb2513c48f6a4282e84c4fb112
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8085-zh-TW.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\8085-zh-TW.js
        • Size 194B
        • SHA256 520e0b2a29d9056cb1c736f3f114601a3e8e1e87341ee568454b87aca8186136
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9259-es-ES.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\9259-es-ES.js
        • Size 4B
        • SHA256 f065737e071f9fbcdf54b8ad38e66e4b6f1f9fa1c01ed6af9d9664d222a96403
        • MD5 SHA1 SHA512
        Submit Download

        entry.js
        • Path C:\Users\Admin\AppData\Local\Feishu\app\webcontent\miniprogram\i18n\entry.js
        • Size 952B
        • SHA256 4281435756fc2f10e8a93137e644b268691739ce27f908297bd8153abd50f385
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7z_dll.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z_dll.dll
        • Size 1.7MB
        • SHA256 0f39605a776a6c6c558ebc11ef87b3e5b423fa686bf3ca36390be6a1063bac93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1524-30-0x000001C3800B0000-0x000001C3801B0000-memory.dmp
        Download

        memory/1524-31-0x000001C3800B0000-0x000001C3801B0000-memory.dmp
        Download

        memory/1524-51-0x000001C383900000-0x000001C383920000-memory.dmp
        Download

        memory/1524-64-0x000001C383B50000-0x000001C383B70000-memory.dmp
        Download

        memory/1524-53-0x000001C393DE0000-0x000001C393EE0000-memory.dmp
        Download

        memory/1524-78-0x000001C3940D0000-0x000001C3940F0000-memory.dmp
        Download

        memory/3132-196-0x0000024AA6320000-0x0000024AA641F000-memory.dmp
        Download