Trojan.Siggen12.39164

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'zoommsirepair' = '"%ProgramFiles(x86)%\Zoom\bin\installer.exe" /repair'
[<HKLM>\Software\Classes\ZoomLauncher\shell\open\command] '' = '"%ProgramFiles(x86)%\Zoom\bin\Zoom.exe" "--url=%1"'
[<HKLM>\Software\Classes\zoommtg\shell\open\command] '' = '"%ProgramFiles(x86)%\Zoom\bin\Zoom.exe" "--url=%1"'
[<HKLM>\Software\Classes\ZoomRecording\shell\open\command] '' = '"%ProgramFiles(x86)%\Zoom\bin\zTscoder.exe" "%1"'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\163da7b0-852d-11eb-a460-beb6fb67143c\target.msi
%ProgramFiles(x86)%\zoom\bin\ztscoder.exe
%ProgramFiles(x86)%\zoom\bin\avutil-52.dll
%ProgramFiles(x86)%\zoom\bin\reslib.dll
%ProgramFiles(x86)%\zoom\bin\nydus.dll
%ProgramFiles(x86)%\zoom\bin\aomagent.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\swresample-3.dll
%ProgramFiles(x86)%\zoom\bin\zvideoapp.dll
%ProgramFiles(x86)%\zoom\bin\mdnsresponder.dll
%ProgramFiles(x86)%\zoom\bin\avcodec-55.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\mphost.exe
%ProgramFiles(x86)%\zoom\bin\aomhost\libcml.dll
%ProgramFiles(x86)%\zoom\bin\meeting_raisehand_chime.pcm
%ProgramFiles(x86)%\zoom\bin\libmpg123.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\zcrashreport64.exe
%ProgramFiles(x86)%\zoom\bin\cmmlib.dll
%ProgramFiles(x86)%\zoom\resources\emojione_low.7z
%ProgramFiles(x86)%\zoom\bin\turbojpeg.dll
%ProgramFiles(x86)%\zoom\bin\zvideoui.dll
%ProgramFiles(x86)%\zoom\bin\nanosvg_license.txt
%ProgramFiles(x86)%\zoom\bin\zcrashreport.dll
%ProgramFiles(x86)%\zoom\bin\droplet.pcm
%ProgramFiles(x86)%\zoom\bin\zmb.dll
C:\users\public\desktop\zoom.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\zoom\zoom.lnk
%WINDIR%\installer\{76266d2d-fd1c-4c97-96c9-f6627552cd14}\_6feff9b68218417f98f549.exe
%ProgramFiles(x86)%\zoom\bin\zoom_launcher.exe
%ProgramFiles(x86)%\zoom\bin\dingdong1.pcm
%ProgramFiles(x86)%\zoom\bin\embedded.properties
%ProgramFiles(x86)%\zoom\bin\zcacert.pem
%ProgramFiles(x86)%\zoom\bin\dingdong.pcm
%ProgramFiles(x86)%\zoom\bin\zsipcallres.dll
%ProgramFiles(x86)%\zoom\bin\cptinstall.exe
%ProgramFiles(x86)%\zoom\bin\aomhost\avcodec-58.dll
%ProgramFiles(x86)%\zoom\bin\installer.exe
%ProgramFiles(x86)%\zoom\bin\ssleay32.dll
%ProgramFiles(x86)%\zoom\bin\annoter.dll
%ProgramFiles(x86)%\zoom\bin\zsipcallapp.dll
%ProgramFiles(x86)%\zoom\bin\avformat-55.dll
%ProgramFiles(x86)%\zoom\bin\cptshare.dll
%ProgramFiles(x86)%\zoom\bin\zautoupdate.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\zmp.dll
%ProgramFiles(x86)%\zoom\bin\cptservice.exe
%ProgramFiles(x86)%\zoom\bin\cpthost.exe
%ProgramFiles(x86)%\zoom\bin\cptcontrol.exe
%ProgramFiles(x86)%\zoom\bin\mcm.dll
%ProgramFiles(x86)%\zoom\zoom\customaction.dll
%ProgramFiles(x86)%\zoom\bin\meeting_chat_chime.pcm
%ProgramFiles(x86)%\zoom\bin\swscale-2.dll
%ProgramFiles(x86)%\zoom\bin\zoom.exe
%ProgramFiles(x86)%\zoom\bin\zsipsdk.dll
%ProgramFiles(x86)%\zoom\bin\root_cert_zpbxcacert.pem
%ProgramFiles(x86)%\zoom\bin\xmppdll.dll
%ProgramFiles(x86)%\zoom\bin\airhost.exe
%ProgramFiles(x86)%\zoom\bin\zdata.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\cldnn64.dll
%ProgramFiles(x86)%\zoom\bin\zzhost.dll
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d
%ProgramFiles(x86)%\zoom\bin\aomhost\swscale-5.dll
%ProgramFiles(x86)%\zoom\bin\zwinres.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\aomhost64.exe
%ProgramFiles(x86)%\zoom\bin\ring.pcm
%ProgramFiles(x86)%\zoom\bin\viper.dll
%ProgramFiles(x86)%\zoom\bin\record_start.pcm
%ProgramFiles(x86)%\zoom\bin\aomhost\zcrashreport64.dll
%ProgramFiles(x86)%\zoom\bin\cmmbrowserengine.dll
%ProgramFiles(x86)%\zoom\bin\libeay32.dll
%ProgramFiles(x86)%\zoom\bin\duilib_license.txt
%ProgramFiles(x86)%\zoom\bin\directui_license.txt
%ProgramFiles(x86)%\zoom\bin\zchatui.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\crashrpt_lang.ini
%ProgramFiles(x86)%\zoom\bin\duilib.dll
%ProgramFiles(x86)%\zoom\bin\npzoomplugin.dll
%ProgramFiles(x86)%\zoom\bin\zcrashreport.exe
%ProgramFiles(x86)%\zoom\bin\msaalib.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\mkldnn.dll
%ProgramFiles(x86)%\zoom\bin\scilexer.dll
%ProgramFiles(x86)%\zoom\bin\zassistant.dll
%ProgramFiles(x86)%\zoom\bin\crashrpt_lang.ini
%ProgramFiles(x86)%\zoom\bin\leave.pcm
%ProgramFiles(x86)%\zoom\bin\zwebservice.dll
%ProgramFiles(x86)%\zoom\bin\ssb_sdk.dll
%ProgramFiles(x86)%\zoom\bin\record_stop.pcm
%ProgramFiles(x86)%\zoom\bin\asproxy.dll
%ProgramFiles(x86)%\zoom\bin\zsipcallui.dll
%ProgramFiles(x86)%\zoom\bin\mdnsclient.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\avformat-58.dll
%ProgramFiles(x86)%\zoom\bin\zlt.dll
%ProgramFiles(x86)%\zoom\bin\aomhost\avutil-56.dll
%ProgramFiles(x86)%\zoom\bin\zchatapp.dll
%ProgramFiles(x86)%\zoom\bin\libfaac.dll
%ProgramFiles(x86)%\zoom\bin\tp.dll
%ProgramFiles(x86)%\zoom\bin\util.dll
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\8890a77645b73478f5b1ded18acbf795_c090a8c88b266c6ff99a97210e92b44d

Удаляет следующие файлы

%ProgramFiles(x86)%\zoom\resources\emojione_low.7z
%TEMP%\163da7b0-852d-11eb-a460-beb6fb67143c\target.msi

Сетевая активность

Подключается к

'ni##te.com':443
'x.##2.us':80
'microsoft.com':80
'o.##2.us':80
'oc##.###tg2.amazontrust.com':80
'oc##.####ca1.amazontrust.com':80
'cr#.####ca1.amazontrust.com':80
'oc##.###1b.amazontrust.com':80
'cr#.####b.amazontrust.com':80

TCP

'ni##te.com':443

UDP

DNS ASK ni##te.com
DNS ASK x.##2.us
DNS ASK microsoft.com
DNS ASK o.##2.us
DNS ASK oc##.###tg2.amazontrust.com
DNS ASK oc##.####ca1.amazontrust.com
DNS ASK cr#.####ca1.amazontrust.com
DNS ASK oc##.###1b.amazontrust.com
DNS ASK cr#.####b.amazontrust.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\zoom\bin\cptinstall.exe' -install -unelevate
'%ProgramFiles(x86)%\zoom\bin\cptinstall.exe' -install -unelevate' (со скрытым окном)

Запускает на исполнение