265c863c1cda7c59859a7e222b30dbadfa2728f0211269ac6f38636e4c486992

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe
Size

7.4MB
MD5

12da661b6214e0c3a0c6e03656cff736
SHA1

aa2d173daec31f87bc940818a650a997b40bbeda
SHA256

c881698a3a5eeecddcc0ede74d8af06e0a5ba7c34e39d04640dca3e45e173936
SHA512

7ada11d4622c12e7b098fec92e8fdd777bd5af6ffb6448b9df11483fbdbd3901afd15052dcadca47604cde2eabbd2437cbbf2ada85fb7476b7ad7ad4c52d1ced
SSDEEP

196608:Z3e1fzaUEn89c92SIjCWV/hSRI+IS+Emf2+Can1Cl:Zuf2n89XS+CWVZa3aff18

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3528	Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe
"C:\Users\Admin\AppData\Local\Temp\Zoom_Player_Premium_6.00_RC2_Plus_SCH.exe"
1⤵
- Loads dropped DLL
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsz84A3.tmp\InstallOptions.dll

Filesize
14KB

MD5
3809b1424d53ccb427c88cabab8b5f94

SHA1
bc74d911216f32a9ca05c0d9b61a2aecfc0d1c0e

SHA256
426efd56da4014f12ec8ee2e268f86b848bbca776333d55482cb3eb71c744088

SHA512
626a1c5edd86a71579e42bac8df479184515e6796fa21cb4fad6731bb775641d25f8eb8e86b939b9db9099453e85c572c9ea7897339a3879a1b672bc9226fcee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz84A3.tmp\ioSpecial.ini

Filesize
792B

MD5
ac01a45fd74eabf872c3096d35cf47a2

SHA1
ffd7841fdacc9c484e08cf460d6f4ab9d3c5480b

SHA256
1d0b5d8d859d0d90e9f5a4a5da6e4eac01a89e78870cf7537d1c777379feafc5

SHA512
9b27c377ce8302ac982473ed64863194eec7977ae3e14a6c7e5e3208570ef7c18126748129ea0a507e0eac1757414220f8e325aa459a60d3d5bd78f3517fe173

Download Submit