265c863c1cda7c59859a7e222b30dbadfa2728f0211269ac6f38636e4c486992

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe
Size

7.4MB
MD5

12da661b6214e0c3a0c6e03656cff736
SHA1

aa2d173daec31f87bc940818a650a997b40bbeda
SHA256

c881698a3a5eeecddcc0ede74d8af06e0a5ba7c34e39d04640dca3e45e173936
SHA512

7ada11d4622c12e7b098fec92e8fdd777bd5af6ffb6448b9df11483fbdbd3901afd15052dcadca47604cde2eabbd2437cbbf2ada85fb7476b7ad7ad4c52d1ced
SSDEEP

196608:Z3e1fzaUEn89c92SIjCWV/hSRI+IS+Emf2+Can1Cl:Zuf2n89XS+CWVZa3aff18

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1916	Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1916	Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe

C:\Users\Admin\AppData\Local\Temp\Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe
"C:\Users\Admin\AppData\Local\Temp\Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nso872C.tmp\ioSpecial.ini

Filesize
792B

MD5
b980eefe0e89bf2b1b6e16ce53b229af

SHA1
fd78ddfd7399584c7b6abdc43551379237bd339d

SHA256
f9df0bee498d60f6a075d8f4c15458846d1838cdcae0685a00ec2586b6d36686

SHA512
7b5081a7fdfd8bb920125f0009463ce1ce66420aa7ad3c6295b3fe4f9c029ef8ea8fe24b1e551e66ef3f2757ab4a1ab0561aeb8fefa4574020a9fa4e4388079d

Download Submit
\Users\Admin\AppData\Local\Temp\nso872C.tmp\InstallOptions.dll

Filesize
14KB

MD5
3809b1424d53ccb427c88cabab8b5f94

SHA1
bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

SHA256
426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

SHA512
626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

Download Submit