[New WTFBin]: RingCentral.exe (Meeting platform)

mttaggart / wtfbins

WTF are these binaries doing?! A list of benign applications that mimic malicious behavior.

MIT License

142 stars 10 forks source link

Closed WidespreadPandemic closed 2 years ago

WidespreadPandemic commented 2 years ago

**Contributor Name: t3chn1qu3_/WSP (@t3chn1qu3_WSP)
**Application/Executable: RingCentral.exe
**WTF Behavior Description: Binary installs deep in AppData, drops a setDefaultAppByProtcol.vbs script, that is then executed to query/create/modify registry entries by running cmd.exe to call cscript //NoLogo and then finally run the vbscript.
**Link to Documentation of Behavior: https://github.com/WidespreadPandemic/RingCentral_WTFBin

mttaggart commented 2 years ago

Added in bf1d9363d4bd28b6c6755acfae6c94c4929fd8ac

HuskyHacks commented 2 years ago

I'm completely serious in saying that I think I'm going to steal that VBS script in your repo for threat emulation prurposes