Overview
overview
3Static
static
38c7661068d...18.exe
windows7-x64
38c7661068d...18.exe
windows10-2004-x64
3DefaultSettings.exe
windows7-x64
1DefaultSettings.exe
windows10-2004-x64
3Zoom Playe...er.exe
windows7-x64
3Zoom Playe...er.exe
windows10-2004-x64
3zpiconlib.dll
windows7-x64
3zpiconlib.dll
windows10-2004-x64
3zplayer.exe
windows7-x64
3zplayer.exe
windows10-2004-x64
3zpresampler.dll
windows7-x64
3zpresampler.dll
windows10-2004-x64
3zpupdate.exe
windows7-x64
3zpupdate.exe
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 23:43
Static task
static1
Behavioral task
behavioral1
Sample
8c7661068d42efcdabff0ccdae38b0df_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8c7661068d42efcdabff0ccdae38b0df_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
DefaultSettings.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
DefaultSettings.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Zoom Player Install Center.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Zoom Player Install Center.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
zpiconlib.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
zpiconlib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
zplayer.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
zplayer.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
zpresampler.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
zpresampler.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
zpupdate.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
zpupdate.exe
Resource
win10v2004-20240802-en
General
-
Target
Zoom Player Install Center.exe
-
Size
728KB
-
MD5
e5fc889bd37e96ce13383b33fb3602eb
-
SHA1
f1029f227bef080bff383779411a931326c5b946
-
SHA256
d307e52142ca4927eaed20eec14c6763235a06076ec3ad0c2053193f3e83df60
-
SHA512
e7848ecebc7c9c39deff56f454db64be916af663497fe053ddfb871dd829dd60d299e52cd5a0ab82a317a9e80795f06e16ad0c2faec3ad8ef300c6e78df49bf1
-
SSDEEP
12288:yrN9GU1vX5muKsTqWmr8/ROa3o8XVhTMRKl19km8tdv+bJ5Hjka+JXHsRD:ybJ1vDKsTqWA8/Fo8DgAJU/GbJ5jy
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zoom Player Install Center.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 Zoom Player Install Center.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2632 Zoom Player Install Center.exe