Overview

overview

7

Static

static

3

zoomagent.exe

windows10-2004-x64

7

zoomagent.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 16:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    zoomagent.exe
  • Size 76.4MB
  • Sample260817-tssdcsvare
  • SHA256 e890ace347e88b817493580db0a75ad11eecd1c3125638f507596e44d51f40ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zoomagent.exe
    "C:\Users\Admin\AppData\Local\Temp\zoomagent.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5932
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3364
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 217A1016C6B0C05EC136E6C9643D62D0
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4584
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /IM FWAInstallMonitor.exe /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:4768
      • C:\ProgramData\FWAInstallMonitor.exe
        "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /Pid 4584
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4948
  • C:\Users\Admin\AppData\Local\Temp\zoomagent.exe
    "C:\Users\Admin\AppData\Local\Temp\zoomagent.exe" -r
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:108
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi" /q REBOOT="ReallySuppress"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CloudAgentCleanupHelper.LOG
        • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
        • Size 26KB
        • SHA256 5f2d4caed5ed755f220cccfe6af0a7045e2665c2babe8e63efe61abd907b5583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CloudAgentCleanupHelper.LOG
        • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
        • Size 1KB
        • SHA256 1afbc65615ca066609fa33e6644ed866f06c473457929af5f603a3d211beead0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CloudAgentCleanupHelper.LOG
        • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
        • Size 22KB
        • SHA256 aec9c6efad7bdac37692c6fe39ed2676c936d58423926df5fb6879709a7c9cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FWAInstallMonitor.exe
        • Path C:\ProgramData\FWAInstallMonitor.exe
        • Size 611KB
        • SHA256 ac9df71193bb7ba777584f417b9f5297d6c746b59058c1ccea6ea73ce3649776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI97e4e.LOG
        • Path C:\Users\Admin\AppData\Local\Temp\MSI97e4e.LOG
        • Size 1KB
        • SHA256 e02dd3ceeb658ace9e610a60f0c65fba7bdde8b4fe71bdc9cfc1152a83399176
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSI99a52.LOG
        • Path C:\Users\Admin\AppData\Local\Temp\MSI99a52.LOG
        • Size 2KB
        • SHA256 123224d1556afa370f62b25091edf1eadb1beb667f450502821ff093cdeb3110
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Cloud Agent_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Cloud Agent_C64.msi
        • Size 9.5MB
        • SHA256 0847a076c23a47a4d8a535cfdc576f2176b14b611e4a10b4d277094bc4bb2bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Imaging Client_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Imaging Client_C64.msi
        • Size 3.3MB
        • SHA256 a4a2c502e225b980374fb360bdbbb5def3b11e8c836308986318903945e0f67b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Software Updater_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Software Updater_C64.msi
        • Size 8.6MB
        • SHA256 c9ecfe319ab8696f4ee0a4e28cf2554335aee583067c0c9e7307f29df6bc1acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Usage Stats_C64.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Usage Stats_C64.msi
        • Size 4.3MB
        • SHA256 6b3c98206e3c88d00e448b11645f844c722c6e6b2cf0df04616c3bca8b9f2f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI8785.tmp
        • Path C:\Windows\Installer\MSI8785.tmp
        • Size 57KB
        • SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI8D91.tmp
        • Path C:\Windows\Installer\MSI8D91.tmp
        • Size 138KB
        • SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI8DF0.tmp
        • Path C:\Windows\Installer\MSI8DF0.tmp
        • Size 1.1MB
        • SHA256 948ac599af61926ae025dd17e12ce7aaf402949b9987faf2cfadd87f591c11c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Products.ini
        • Path C:\Windows\Products.ini
        • Size 380B
        • SHA256 63c971a11b6aff3bceaed294eea37bd521c2c39fc9a00ad2c918ffc57bd1fb62
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/3364-72-0x0000027080610000-0x0000027080FB4000-memory.dmp
        Download