Trojan.Siggen11.62029

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\ZoomLauncher\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" "--url=%1"'
[<HKCU>\Software\Classes\zoommtg\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" "--url=%1"'
[<HKCU>\Software\Classes\ZoomRecording\shell\open\command] '' = '"%APPDATA%\Zoom\bin\zTscoder.exe" "%1"'
[<HKCU>\SOFTWARE\Classes\ZoomPhoneCall\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" --url="%l"'
[<HKCU>\SOFTWARE\Classes\ZoomPbx.zoomphonecall\shell\open\command] '' = '"%APPDATA%\Zoom\bin\Zoom.exe" --url="%l"'

Modifies file system

Creates the following files

%TEMP%\7zs825e3a80\installer.exe
%APPDATA%\zoom\tmp_bin\aomagent.dll
%APPDATA%\zoom\tmp_bin\meeting_raisehand_chime.pcm
%APPDATA%\zoom\tmp_bin\meeting_chat_chime.pcm
%APPDATA%\zoom\tmp_bin\droplet.pcm
%APPDATA%\zoom\tmp_bin\dllsafecheck.dll
%APPDATA%\zoom\tmp_bin\zupdater.exe
%APPDATA%\zoom\tmp_bin\api-ms-win-core-console-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-console-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-datetime-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-errorhandling-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-namedpipe-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-file-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-file-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-file-l2-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-handle-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-heap-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-interlocked-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-libraryloader-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-localization-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-memory-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\nanosvg_license.txt
%APPDATA%\zoom\tmp_bin\api-ms-win-core-debug-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\libmpg123.dll
%APPDATA%\zoom\tmp_bin\annoter.dll
%APPDATA%\zoom\tmp_bin\zlt.dll
%APPDATA%\zoom\tmp_bin\zmb.dll
%APPDATA%\zoom\tmp_bin\zoom.exe
%APPDATA%\zoom\tmp_bin\zoom_launcher.exe
%APPDATA%\zoom\tmp_bin\zoominstall.xml
%APPDATA%\zoom\tmp_bin\ztscoder.exe
%APPDATA%\zoom\tmp_bin\zvideoapp.dll
%APPDATA%\zoom\tmp_bin\zvideoui.dll
%APPDATA%\zoom\tmp_bin\zwebservice.dll
%APPDATA%\zoom\tmp_uninstall\installer.exe
%APPDATA%\zoom\tmp_bin\cptcontrol.exe
%APPDATA%\zoom\tmp_bin\reslib.dll
%APPDATA%\zoom\tmp_bin\duilib.dll
%APPDATA%\zoom\tmp_bin\directui_license.txt
%APPDATA%\zoom\tmp_bin\duilib_license.txt
%APPDATA%\zoom\tmp_bin\xmppdll.dll
%APPDATA%\zoom\tmp_bin\asproxy.dll
%APPDATA%\zoom\tmp_bin\leave.pcm
%APPDATA%\zoom\tmp_bin\cptinstall.exe
%APPDATA%\zoom\tmp_bin\cptservice.exe
%APPDATA%\zoom\tmp_bin\zzhost.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-processenvironment-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-processthreads-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-processthreads-l1-1-1.dll
%APPDATA%\zoom\tmp_bin\msvcp140_1.dll
%APPDATA%\zoom\tmp_bin\msvcp140_2.dll
%APPDATA%\zoom\tmp_bin\msvcp140_codecvt_ids.dll
%APPDATA%\zoom\tmp_bin\ucrtbase.dll
%APPDATA%\zoom\tmp_bin\vccorlib140.dll
%APPDATA%\zoom\tmp_bin\vcruntime140.dll
%APPDATA%\zoom\tmp_bin\ztoastnotification.dll
%APPDATA%\zoom\tmp_bin\zoomdocconverter.exe
%APPDATA%\zoom\tmp_bin\concrt140.dll
%APPDATA%\zoom\tmp_bin\msvcp140.dll
%APPDATA%\zoom\tmp_bin\zoomoutlookimplugin.exe
%APPDATA%\zoom\tmp_bin\zkbcrypto.dll
%APPDATA%\zoom\tmp_bin\libfdkaac2.dll
%APPDATA%\microsoft\windows\start menu\programs\zoom\zoom.lnk
%APPDATA%\microsoft\windows\start menu\programs\zoom\uninstall zoom.lnk
%APPDATA%\zoom\data\zoom.us.ini
%APPDATA%\zoom\data\zoomus.enc.db-journal
%APPDATA%\zoom\data\zoomus.enc.db
%APPDATA%\zoom\data\zoomus.tmp.enc.db-journal
%APPDATA%\zoom\tmp_bin\uibase.dll
%APPDATA%\zoom\tmp_bin\zoutlookimutil.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-utility-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-time-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-string-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-rtlsupport-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-string-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-synch-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-synch-l1-2-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-sysinfo-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-timezone-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-util-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-xstate-l2-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-conio-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-core-profile-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-convert-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-filesystem-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-heap-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-locale-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-math-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-multibyte-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-private-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-process-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-runtime-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-stdio-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\api-ms-win-crt-environment-l1-1-0.dll
%APPDATA%\zoom\tmp_bin\zwinres.dll
%APPDATA%\zoom\data\zoomus.tmp.enc.db
%APPDATA%\zoom\tmp_bin\zdata.dll
%APPDATA%\zoom\tmp_bin\zcrashreport.dll
%APPDATA%\zoom\zoom_install_src\cpthost.exe
%APPDATA%\zoom\zoom_install_src\cptinstall.exe
%APPDATA%\zoom\zoom_install_src\cptservice.exe
%APPDATA%\zoom\zoom_install_src\cptshare.dll
%APPDATA%\zoom\zoom_install_src\dllsafecheck.dll
%APPDATA%\zoom\zoom_install_src\duilib.dll
%APPDATA%\zoom\zoom_install_src\installer.exe
%APPDATA%\zoom\zoom_install_src\libcrypto-1_1.dll
%APPDATA%\zoom\zoom_install_src\libfdkaac2.dll
%APPDATA%\zoom\zoom_install_src\libssl-1_1.dll
%APPDATA%\zoom\zoom_install_src\viper.dll
%APPDATA%\zoom\zoom_install_src\mcm.dll
%APPDATA%\zoom\zoom_install_src\msaalib.dll
%APPDATA%\zoom\zoom_install_src\nydus.dll
%APPDATA%\zoom\zoom_install_src\reslib.dll
%APPDATA%\zoom\zoom_install_src\ssb_sdk.dll
%APPDATA%\zoom\zoom_install_src\tp.dll
%APPDATA%\zoom\zoom_install_src\turbojpeg.dll
%APPDATA%\zoom\zoom_install_src\uibase.dll
%APPDATA%\zoom\zoom_install_src\util.dll
%APPDATA%\zoom\zoom_install_src\cptcontrol.exe
%APPDATA%\zoom\zoom_install_src\libmpg123.dll
%APPDATA%\zoom\zoom_install_src\cmmlib.dll
%APPDATA%\zoom\zoom_install_src\meeting_chat_chime.pcm
%TEMP%\7zs825e3a80\zoom.msi
%APPDATA%\zoom\installer.txt
%APPDATA%\zoom\zoom_install_src\crashrpt_lang.ini
%APPDATA%\zoom\zoom_install_src\dingdong.pcm
%APPDATA%\zoom\zoom_install_src\dingdong1.pcm
%APPDATA%\zoom\zoom_install_src\directui_license.txt
%APPDATA%\zoom\zoom_install_src\droplet.pcm
%APPDATA%\zoom\zoom_install_src\duilib_license.txt
%APPDATA%\zoom\zoom_install_src\leave.pcm
%APPDATA%\zoom\zoom_install_src\meeting_raisehand_chime.pcm
%APPDATA%\zoom\zoom_install_src\asproxy.dll
%APPDATA%\zoom\zoom_install_src\nanosvg_license.txt
%APPDATA%\zoom\zoom_install_src\record_start.pcm
%APPDATA%\zoom\zoom_install_src\record_stop.pcm
%APPDATA%\zoom\zoom_install_src\ring.pcm
%APPDATA%\zoom\zoom_install_src\win10rt.7z
%APPDATA%\zoom\zoom_install_src\wr_ding.pcm
%APPDATA%\zoom\zoom_install_src\zoominstall.xml
%APPDATA%\zoom\zoom_install_src\annoter.dll
%APPDATA%\zoom\zoom_install_src\aomagent.dll
%APPDATA%\zoom\zoom_install_src\cmmbrowserengine.dll
%APPDATA%\zoom\zoom_install_src\xmppdll.dll
%APPDATA%\zoom\zoom_install_src\zautoupdate.dll
%APPDATA%\zoom\zoom_install_src\zchatapp.dll
%APPDATA%\zoom\tmp_bin\installer.exe
%APPDATA%\zoom\tmp_bin\libcrypto-1_1.dll
%APPDATA%\zoom\tmp_bin\mcm.dll
%APPDATA%\zoom\tmp_bin\nydus.dll
%APPDATA%\zoom\tmp_bin\ring.pcm
%APPDATA%\zoom\tmp_bin\dingdong.pcm
%APPDATA%\zoom\tmp_bin\dingdong1.pcm
%APPDATA%\zoom\tmp_bin\record_start.pcm
%APPDATA%\zoom\tmp_bin\cptshare.dll
%APPDATA%\zoom\tmp_bin\crashrpt_lang.ini
%APPDATA%\zoom\tmp_bin\record_stop.pcm
%APPDATA%\zoom\tmp_bin\libssl-1_1.dll
%APPDATA%\zoom\tmp_bin\tp.dll
%APPDATA%\zoom\tmp_bin\turbojpeg.dll
%APPDATA%\zoom\tmp_bin\util.dll
%APPDATA%\zoom\tmp_bin\viper.dll
%APPDATA%\zoom\tmp_bin\zautoupdate.dll
%APPDATA%\zoom\tmp_bin\zchatapp.dll
%APPDATA%\zoom\tmp_bin\zchatui.dll
%APPDATA%\zoom\tmp_bin\wr_ding.pcm
%APPDATA%\zoom\tmp_bin\ssb_sdk.dll
%APPDATA%\zoom\tmp_bin\cpthost.exe
%APPDATA%\zoom\tmp_bin\cmmlib.dll
%APPDATA%\zoom\tmp_bin\cmmbrowserengine.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport.exe
%APPDATA%\zoom\zoom_install_src\zdata.dll
%APPDATA%\zoom\zoom_install_src\zkbcrypto.dll
%APPDATA%\zoom\zoom_install_src\zlt.dll
%APPDATA%\zoom\zoom_install_src\zmb.dll
%APPDATA%\zoom\zoom_install_src\zoom.exe
%APPDATA%\zoom\zoom_install_src\zoomdocconverter.exe
%APPDATA%\zoom\zoom_install_src\zoomoutlookimplugin.exe
%APPDATA%\zoom\zoom_install_src\zchatui.dll
%APPDATA%\zoom\zoom_install_src\zoom_launcher.exe
%APPDATA%\zoom\zoom_install_src\ztoastnotification.dll
%APPDATA%\zoom\zoom_install_src\ztscoder.exe
%APPDATA%\zoom\zoom_install_src\zupdater.exe
%APPDATA%\zoom\zoom_install_src\zvideoapp.dll
%APPDATA%\zoom\zoom_install_src\zvideoui.dll
%APPDATA%\zoom\zoom_install_src\zwebservice.dll
%APPDATA%\zoom\zoom_install_src\zwinres.dll
%APPDATA%\zoom\zoom_install_src\zzhost.dll
%APPDATA%\zoom\tmp_bin\msaalib.dll
%APPDATA%\zoom\zoom_install_src\zoutlookimutil.dll
%APPDATA%\zoom\tmp_bin\zcrashreport.exe
%APPDATA%\zoom\data\viper.ini

Deletes the following files

%APPDATA%\zoom\zoom_install_src\annoter.dll
%APPDATA%\zoom\zoom_install_src\zkbcrypto.dll
%APPDATA%\zoom\zoom_install_src\zdata.dll
%APPDATA%\zoom\zoom_install_src\zcrashreport.exe
%APPDATA%\zoom\zoom_install_src\zcrashreport.dll
%APPDATA%\zoom\zoom_install_src\zchatui.dll
%APPDATA%\zoom\zoom_install_src\zmb.dll
%APPDATA%\zoom\zoom_install_src\zchatapp.dll
%APPDATA%\zoom\zoom_install_src\xmppdll.dll
%APPDATA%\zoom\zoom_install_src\wr_ding.pcm
%APPDATA%\zoom\zoom_install_src\win10rt.7z
%APPDATA%\zoom\zoom_install_src\viper.dll
%APPDATA%\zoom\zoom_install_src\util.dll
%APPDATA%\zoom\zoom_install_src\uibase.dll
%APPDATA%\zoom\zoom_install_src\zautoupdate.dll
%APPDATA%\zoom\zoom_install_src\meeting_chat_chime.pcm
%APPDATA%\zoom\zoom_install_src\zoom.exe
%TEMP%\7zs825e3a80\zoom.msi
%TEMP%\7zs825e3a80\installer.exe
%APPDATA%\zoom\zoom_install_src\zzhost.dll
%APPDATA%\zoom\zoom_install_src\zwinres.dll
%APPDATA%\zoom\zoom_install_src\zwebservice.dll
%APPDATA%\zoom\zoom_install_src\zvideoui.dll
%APPDATA%\zoom\zoom_install_src\turbojpeg.dll
%APPDATA%\zoom\zoom_install_src\zlt.dll
%APPDATA%\zoom\zoom_install_src\ztscoder.exe
%APPDATA%\zoom\zoom_install_src\ztoastnotification.dll
%APPDATA%\zoom\zoom_install_src\zoutlookimutil.dll
%APPDATA%\zoom\zoom_install_src\zoom_launcher.exe
%APPDATA%\zoom\zoom_install_src\zoomoutlookimplugin.exe
%APPDATA%\zoom\zoom_install_src\zoominstall.xml
%APPDATA%\zoom\zoom_install_src\zupdater.exe
%APPDATA%\zoom\zoom_install_src\zoomdocconverter.exe
%APPDATA%\zoom\zoom_install_src\tp.dll
%APPDATA%\zoom\zoom_install_src\ssb_sdk.dll
%APPDATA%\zoom\zoom_install_src\ring.pcm
%APPDATA%\zoom\zoom_install_src\cptinstall.exe
%APPDATA%\zoom\zoom_install_src\aomagent.dll
%APPDATA%\zoom\zoom_install_src\asproxy.dll
%APPDATA%\zoom\zoom_install_src\cmmbrowserengine.dll
%APPDATA%\zoom\zoom_install_src\cmmlib.dll
%APPDATA%\zoom\zoom_install_src\cptcontrol.exe
%APPDATA%\zoom\data\zoomus.enc.db-journal
%APPDATA%\zoom\zoom_install_src\cpthost.exe
%APPDATA%\zoom\zoom_install_src\droplet.pcm
%APPDATA%\zoom\zoom_install_src\cptshare.dll
%APPDATA%\zoom\zoom_install_src\crashrpt_lang.ini
%APPDATA%\zoom\zoom_install_src\dingdong.pcm
%APPDATA%\zoom\zoom_install_src\dingdong1.pcm
%APPDATA%\zoom\zoom_install_src\directui_license.txt
%APPDATA%\zoom\zoom_install_src\cptservice.exe
%APPDATA%\zoom\zoom_install_src\zvideoapp.dll
%APPDATA%\zoom\zoom_install_src\duilib.dll
%APPDATA%\zoom\zoom_install_src\leave.pcm
%APPDATA%\zoom\zoom_install_src\duilib_license.txt
%APPDATA%\zoom\zoom_install_src\reslib.dll
%APPDATA%\zoom\zoom_install_src\record_stop.pcm
%APPDATA%\zoom\zoom_install_src\record_start.pcm
%APPDATA%\zoom\zoom_install_src\nydus.dll
%APPDATA%\zoom\zoom_install_src\nanosvg_license.txt
%APPDATA%\zoom\zoom_install_src\installer.exe
%APPDATA%\zoom\zoom_install_src\msaalib.dll
%APPDATA%\zoom\zoom_install_src\dllsafecheck.dll
%APPDATA%\zoom\zoom_install_src\mcm.dll
%APPDATA%\zoom\zoom_install_src\libssl-1_1.dll
%APPDATA%\zoom\zoom_install_src\libmpg123.dll
%APPDATA%\zoom\zoom_install_src\libfdkaac2.dll
%APPDATA%\zoom\zoom_install_src\libcrypto-1_1.dll
%APPDATA%\zoom\zoom_install_src\meeting_raisehand_chime.pcm
%APPDATA%\zoom\data\zoomus.tmp.enc.db-journal

Substitutes the following files

%APPDATA%\zoom\data\zoomus.enc.db-journal

Network activity

Connects to

'zo#m.us':443

TCP

'zo#m.us':443

UDP

DNS ASK zo#m.us
'19#.#51.234.30':3478
'14#.#37.83.30':3478
'14#.#37.83.30':3479

Miscellaneous

Searches for the following windows

ClassName: 'zoom.us Installer Engine' WindowName: 'Zoom Installer'

Creates and executes the following

'%TEMP%\7zs825e3a80\installer.exe'
'%TEMP%\7zs825e3a80\installer.exe' /addfwexception --bin_home="%APPDATA%\Zoom\bin"
'%TEMP%\7zs825e3a80\installer.exe' /addfwexception --bin_home="%APPDATA%\Zoom\bin"' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial