Edit tour

Windows Analysis Report
Zoom.exe

Overview

General Information

Sample name:	Zoom.exe
Analysis ID:	1557990
MD5:	da30eab35f763bc0c5100f7da5f8e676
SHA1:	218134a4b2e2d00ea18cf528ae35431a01474fe3
SHA256:	80e520bd05e9f430994d7108aa44e756421bb5ba84ef12972ecb280545bcef3a
Tags:	exeuser-N3utralZ0ne
Infos:

Detection

PureCrypter, MicroClip

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Set autostart key via New-ItemProperty Cmdlet

Suricata IDS alerts for network traffic

Yara detected MicroClip

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

AI detected suspicious sample

Detected PureCrypter Trojan

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Zoom.exe (PID: 6496 cmdline: "C:\Users\user\Desktop\Zoom.exe" MD5: DA30EAB35F763BC0C5100F7DA5F8E676)

powershell.exe (PID: 7156 cmdline: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Zoom.exe (PID: 5044 cmdline: "C:\Users\user\AppData\Roaming\Zoom.exe" MD5: DA30EAB35F763BC0C5100F7DA5F8E676)

Zoom.exe (PID: 2292 cmdline: "C:\Users\user\AppData\Roaming\Zoom.exe" MD5: DA30EAB35F763BC0C5100F7DA5F8E676)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Zoom.exe PID: 6496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Zoom.exe PID: 6496	JoeSecurity_MicroClip	Yara detected MicroClip	Joe Security
Process Memory Space: Zoom.exe PID: 5044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Zoom.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zoom

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Zoom.exe", ParentImage: C:\Users\user\Desktop\Zoom.exe, ParentProcessId: 6496, ParentProcessName: Zoom.exe, ProcessCommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String', ProcessId: 7156, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Set autostart key via New-ItemProperty Cmdlet

Source: Process started

Author: Joe Security: Data: Command: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String', CommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String', CommandLine|base64offset|contains: E^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Zoom.exe", ParentImage: C:\Users\user\Desktop\Zoom.exe, ParentProcessId: 6496, ParentProcessName: Zoom.exe, ProcessCommandLine: "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String', ProcessId: 7156, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Generic AsyncRAT Style SSL Cert

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T20:46:11.550490+0100	2035595	1	Domain Observed Used for C2 Detected	172.81.130.139	56001	192.168.2.5	49704	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Zoom.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zoom.exe

Avira: detection malicious, Label: HEUR/AGEN.1323341

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zoom.exe

ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: Zoom.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Zoom.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Zoom.exe

Joe Sandbox ML: detected

Source: Zoom.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Zoom.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2035595 - Severity 1 - ET MALWARE Generic AsyncRAT Style SSL Cert : 172.81.130.139:56001 -> 192.168.2.5:49704

Source: Joe Sandbox View

ASN Name: DATAWAGONUS DATAWAGONUS

Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139
Source: unknown	TCP traffic detected without corresponding DNS query: 172.81.130.139

Source: powershell.exe, 00000002.00000002.2076162638.000000000319D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000002.00000002.2088828355.0000000007902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft/
Source: Zoom.exe, 00000000.00000002.4517013238.000000000140C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Zoom.exe, 00000000.00000002.4517013238.00000000013D1000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.0.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000002.00000002.2087313785.000000000608B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.2077345397.0000000005176000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2088828355.0000000007902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2077345397.0000000005021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2077345397.0000000005176000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2088828355.0000000007902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.2077345397.0000000005021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBjq
Source: powershell.exe, 00000002.00000002.2087313785.000000000608B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2087313785.000000000608B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2087313785.000000000608B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Zoom.exe, 00000000.00000002.4519895828.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/WebDriver.dll
Source: Zoom.exe, 00000000.00000002.4519895828.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/chromedriver.exe
Source: Zoom.exe, 00000000.00000002.4519895828.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DFfe9ewf/test3/raw/refs/heads/main/msedgedriver.exe
Source: powershell.exe, 00000002.00000002.2077345397.0000000005176000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2088828355.0000000007902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2087313785.000000000608B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Zoom.exe, 00000000.00000002.4519895828.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Zoom.exe, 00000000.00000002.4519895828.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Zoom.exe, 00000000.00000002.4519895828.000000000331C000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, Zoom.exe, 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot

System Summary

.NET source code contains very large array initializations

Source: Zoom.exe, RulesSingletonConnector.cs	Large array initialization: PopStub: array initializer size 297280
Source: Zoom.exe.0.dr, RulesSingletonConnector.cs	Large array initialization: PopStub: array initializer size 297280

Source: C:\Users\user\Desktop\Zoom.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_015B40C2	0_2_015B40C2
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_015B4258	0_2_015B4258
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_015B14D0	0_2_015B14D0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_015B14E0	0_2_015B14E0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF1600	0_2_06DF1600
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF6369	0_2_06DF6369
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF40E0	0_2_06DF40E0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF0D30	0_2_06DF0D30
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF09E8	0_2_06DF09E8
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF3695	0_2_06DF3695
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF642D	0_2_06DF642D
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF6372	0_2_06DF6372
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF40D0	0_2_06DF40D0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF4038	0_2_06DF4038
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF5E3A	0_2_06DF5E3A
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF5E31	0_2_06DF5E31
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF5F18	0_2_06DF5F18
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07690D75	0_2_07690D75
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076921A0	0_2_076921A0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07691F01	0_2_07691F01
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07691F10	0_2_07691F10
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076BEA50	0_2_076BEA50
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076B3960	0_2_076B3960
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076BC7E0	0_2_076BC7E0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076C8C20	0_2_076C8C20
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07704EC0	0_2_07704EC0
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07700D7F	0_2_07700D7F
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_0770E17C	0_2_0770E17C
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07700DE6	0_2_07700DE6
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_0770535B	0_2_0770535B
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_0853EEA8	0_2_0853EEA8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D813A5	2_2_04D813A5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D88B00	2_2_04D88B00
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_011514D0	4_2_011514D0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_011514E0	4_2_011514E0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B1E	4_2_01151B1E
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B07	4_2_01151B07
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B33	4_2_01151B33
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B4A	4_2_01151B4A
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B7A	4_2_01151B7A
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B62	4_2_01151B62
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151B92	4_2_01151B92
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01153BEF	4_2_01153BEF
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151AA8	4_2_01151AA8
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151AA8	4_2_01151AA8
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01151AF2	4_2_01151AF2
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01153CA2	4_2_01153CA2
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_01152F25	4_2_01152F25
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052B5150	4_2_052B5150
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052B4DF0	4_2_052B4DF0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052B5142	4_2_052B5142
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052B4DE0	4_2_052B4DE0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052B9AF8	4_2_052B9AF8
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052B9AF3	4_2_052B9AF3
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_0530E160	4_2_0530E160
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_05306828	4_2_05306828
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_05300280	4_2_05300280
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_0530076D	4_2_0530076D
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_05302128	4_2_05302128
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_05309958	4_2_05309958
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_053048E0	4_2_053048E0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_0530F330	4_2_0530F330
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_01311758	6_2_01311758
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_013141D1	6_2_013141D1
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_01314258	6_2_01314258
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_013114E0	6_2_013114E0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_013114D0	6_2_013114D0
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_01311758	6_2_01311758
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 6_2_01313DCB	6_2_01313DCB

Source: Zoom.exe, 00000000.00000002.4533314629.00000000043E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePluginClipper.dll" vs Zoom.exe
Source: Zoom.exe, 00000000.00000002.4533314629.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePluginTV.dll" vs Zoom.exe
Source: Zoom.exe, 00000000.00000002.4517013238.000000000139E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Zoom.exe
Source: Zoom.exe, 00000000.00000000.2061124344.0000000000D9A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNeqpcwp.exe" vs Zoom.exe
Source: Zoom.exe, 00000000.00000002.4550294257.0000000007500000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePluginClipper.dll" vs Zoom.exe
Source: Zoom.exe, 00000000.00000002.4533314629.00000000046A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePluginTV.dll" vs Zoom.exe
Source: Zoom.exe, 00000000.00000002.4556701879.0000000007E40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePluginTV.dll" vs Zoom.exe
Source: Zoom.exe, 00000000.00000002.4533314629.0000000004169000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePluginClipper.dll" vs Zoom.exe
Source: Zoom.exe, 00000004.00000002.2369234076.0000000003DB5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZapjprdi.dll" vs Zoom.exe
Source: Zoom.exe, 00000004.00000002.2373291863.00000000054E0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameZapjprdi.dll" vs Zoom.exe
Source: Zoom.exe, 00000004.00000002.2358641314.000000000116E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Zoom.exe
Source: Zoom.exe, 00000004.00000002.2363736434.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZapjprdi.dll" vs Zoom.exe
Source: Zoom.exe, 00000006.00000002.2451736368.00000000041E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameZapjprdi.dll" vs Zoom.exe
Source: Zoom.exe	Binary or memory string: OriginalFilenameNeqpcwp.exe" vs Zoom.exe
Source: Zoom.exe.0.dr	Binary or memory string: OriginalFilenameNeqpcwp.exe" vs Zoom.exe

Source: Zoom.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: Zoom.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Zoom.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Zoom.exe, RulesSingletonConnector.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Zoom.exe, WatcherCodeInstance.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Zoom.exe, WatcherCodeInstance.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Zoom.exe.0.dr, RulesSingletonConnector.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Zoom.exe.0.dr, WatcherCodeInstance.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Zoom.exe.0.dr, WatcherCodeInstance.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/7@0/1

Source: C:\Users\user\Desktop\Zoom.exe

File created: C:\Users\user\AppData\Roaming\Zoom.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Zoom.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Users\user\Desktop\Zoom.exe	Mutant created: \Sessions\1\BaseNamedObjects\c133332651f9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k0k1tt4g.w2s.ps1

Jump to behavior

Source: Zoom.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Zoom.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\Zoom.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Zoom.exe

ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\Zoom.exe

File read: C:\Users\user\Desktop\Zoom.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Zoom.exe "C:\Users\user\Desktop\Zoom.exe"
Source: C:\Users\user\Desktop\Zoom.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Zoom.exe "C:\Users\user\AppData\Roaming\Zoom.exe"
Source: C:\Users\user\Desktop\Zoom.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String'	Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Zoom.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Zoom.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: Zoom.exe, WatcherCodeInstance.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: Zoom.exe.0.dr, WatcherCodeInstance.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: Zoom.exe, Consumer.cs	.Net Code: ForgotTokenizer System.Reflection.Assembly.Load(byte[])
Source: Zoom.exe.0.dr, Consumer.cs	.Net Code: ForgotTokenizer System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Users\user\Desktop\Zoom.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String'
Source: C:\Users\user\Desktop\Zoom.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String'			Jump to behavior

Source: Zoom.exe

Static PE information: 0xACB26237 [Mon Oct 24 09:28:23 2061 UTC]

Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DF7148 push FFFFFF98h; retf	0_2_06DF715E
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DFD110 pushfd ; retf	0_2_06DFD11D
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_06DFFF72 push es; retf	0_2_06DFFF73
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07645F10 push 04418B07h; ret	0_2_07645F33
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07649698 push B0059E7Eh; ret	0_2_076496B5
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_0769875A push edx; retf	0_2_07698761
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07696549 push cs; iretd	0_2_0769654F
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07697D5A push FFFFFFB3h; retf	0_2_07697D5C
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07699357 push cs; iretd	0_2_0769935F
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_07698AE5 push ss; ret	0_2_07698AE8
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076BA786 push edi; ret	0_2_076BA788
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076BA677 push edi; ret	0_2_076BA679
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076B9C62 push 8BFFFFFCh; retf	0_2_076B9C67
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076C6378 push 8BFFFFFFh; iretd	0_2_076C637E
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_076C7104 push esp; ret	0_2_076C7109
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_0852454B push B807CF9Ch; iretd	0_2_08524555
Source: C:\Users\user\Desktop\Zoom.exe	Code function: 0_2_085350FF push edi; ret	0_2_08535101
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D80CD0 push eax; ret	2_2_04D80CDA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D80CC0 push eax; ret	2_2_04D80CCA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D80CB0 push eax; ret	2_2_04D80CBA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D80C49 push eax; ret	2_2_04D80C4A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04D80C70 push eax; ret	2_2_04D80CAA
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_052F4623 push esp; ret	4_2_052F463D
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_053059B3 push EC053173h; retf	4_2_053059BD
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_0530EB2B pushfd ; retf	4_2_0530EB31
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_0530F230 push esp; iretd	4_2_0530F231
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Code function: 4_2_0530EAAB push esp; retf	4_2_0530EAB1

Source: Zoom.exe	Static PE information: section name: .text entropy: 7.8678306288821815
Source: Zoom.exe.0.dr	Static PE information: section name: .text entropy: 7.8678306288821815

Source: C:\Users\user\Desktop\Zoom.exe

File created: C:\Users\user\AppData\Roaming\Zoom.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Zoom			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Zoom			Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT			Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\197E6E777F059FE30F6E8292393F615F 57cea44528b4a4ada7e68dbaaab9333c

Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_DiskDrive

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_PhysicalMemory

Source: C:\Users\user\Desktop\Zoom.exe	Memory allocated: 15B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Memory allocated: 1740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Memory allocated: 4CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Memory allocated: 1310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Memory allocated: 1540000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Zoom.exe

Code function: 6_2_01311059 rdtsc

6_2_01311059

Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe	Window / User API: threadDelayed 2986	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Window / User API: threadDelayed 6683	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5954	Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe TID: 320	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -35000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -34796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -34375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -34231s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -34123s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -34012s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -33077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32311s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -32082s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31757s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31528s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -31093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe TID: 6624	Thread sleep time: -30109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5000	Thread sleep count: 5954 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep count: 259 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe TID: 2704	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe TID: 1120	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 35000	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 34796	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 34375	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 34231	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 34123	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 34012	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33859	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33733	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33624	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33515	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33406	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33296	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33187	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 33077	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32968	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32859	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32750	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32640	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32531	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32421	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32311	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32203	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 32082	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31757	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31640	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31528	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31421	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31312	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31203	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 31093	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30984	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30874	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30765	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30656	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30546	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30437	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30328	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30218	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Thread delayed: delay time: 30109	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Zoom.exe, 00000000.00000002.4547570275.0000000006727000.00000004.00000020.00020000.00000000.sdmp, Zoom.exe, 00000000.00000002.4517013238.000000000140C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Zoom.exe

Code function: 6_2_01311059 rdtsc

6_2_01311059

Source: C:\Users\user\Desktop\Zoom.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Detected PureCrypter Trojan

Source: Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: 172.81.130.139MIIE6DCCAtCgAwIBAgIQAPVTIUeAi1ZxDDUvyf/w+zANBgkqhkiG9w0BAQ0FADAVMRMwEQYDVQQDDApTamJkZ2V2b2ViMCAXDTI0MTExMzEyNTAyOVoYDzk5OTkxMjMxMjM1OTU5WjAVMRMwEQYDVQQDDApTamJkZ2V2b2ViMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAybTZ2IfPpLYTU/C7aphX2Asxw0mb2BMwkqvsfceaeF0Ce0001VvyTe8qMNi0oOIes2XTH8nNsk3cceHTAu73eIWPIJXopiBcaL/u+kUaaztjO4NvPWCYeQdC8hfbQRHxroVvSU4JMKef/fApH64vqFThpKteiJqNYmywm3MzfuaKMNE3VVtvU6uJ5IExI49V05LD3Qt9PQ2NMW9z9WNwTKcH29xEukmrvmaVlaoe1NxL2BNBrDmgCgzYm+KtDxaL69YU3EK56hvzNvJF+OKLpOlshBbhpWGzAUAxDvCVrH0YbzsFEYnEKJlJtJz6bWh48V1fi/wXnXokEVZoGrVDqpQgAgvR0iu/qaiy4KIOiz9xUgkKu4dEgrn9IrXlJS/k0yp9chTUrbMPhA4eakMfitbAHJvsUKUx57OL7SqoXOruTTeI5cSdqytwiQ7jeaGxE7Gvt/BZWMsD/zADWWc7ShxePLBS8F6FE51QHv0JyoSf8j1+qqtC0p3in4GXIJdK7on73RMDZMtrCcksKsmVUYvHKpz/+Dh5Y8Z7jVBlWZYWqxiZiBqQnX7lzXbUW0RWJNA7wJOo7JSYWFeUMearAZHusocRrCZJ5c4TAvtZTVshMEMyu9+ceEMWEL289doH5OH1XEbQBwyKA4ah5hOg9APv9GpAymm9HrbLcQyvTccCAwEAAaMyMDAwHQYDVR0OBBYEFIWRNz6dBqNhU5l4J/V05+pT3nycMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAH/BWlLBvnn4mRunJhQWOzez/LMauTzwGPnQsTaRumYga8OGRjOpUW/7MwMsfUcAKXSiqc6JLVmS6lwBMYwXUxjZid7sjR1DdreoFdHV+X63BopDHdG6Oz3nr+rFjEMXNtGcTsUYKVHUwC3dam9bHCl6VOB11T8emx2UoTAjeFPtyN4UFg2JJ0p5DGbAW135v0ifUsdc3bGA9CaOWa6qFfqGJOjrrDLVqzp0ekhRhPsevFrTBrfMEbk4aUL4u1QpbnTXWvhWeac8Zi9TAVZ1DE0CzmJJvAzkbTchtmNcBh6jihXBSdn/iFSPfVQ51Y3hl2L8NiXqc5t4ZQwBYfzYEuorCiW+G+K6NLlWd6Gm9CtvtB/+ncPy6BvoKp4AKDtWNN/HMwbcLsiY87+yZgIo8VRzhI8GnDwubriX6NqNwoZS3yW90bRDqlu+hHVrvhvuJuLsQwVErbZ0MjCN7g+SOauWib8Kft/TFCVe1NcnQY7dqK9ceR1BjbhLMrjhlN9FSRjFyFXzGs+Gy20jE0TS7vk1nO6hsg//5wgob8cJHFDxoih/9KfqLJ2vsYk1zbasm/HCwS6mlf0hsN2wfLBQs+lp/kUUG2x+zaPrmR/RCVX7Get5A8QbWhcdrTFjg/w6gkiUzlrE7LlwinHjOiNxm2Mw7jiVC4bgdSXwa32Ffskd"Default(:Zoom.exeBAPPDATAJc133332651f9

Source: C:\Users\user\Desktop\Zoom.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Zoom' -Value '"C:\Users\user\AppData\Roaming\Zoom.exe"' -PropertyType 'String'

Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'zoom';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'zoom' -value '"c:\users\user\appdata\roaming\zoom.exe"' -propertytype 'string'
Source: C:\Users\user\Desktop\Zoom.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'zoom';new-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\run' -name 'zoom' -value '"c:\users\user\appdata\roaming\zoom.exe"' -propertytype 'string'			Jump to behavior

Source: Zoom.exe, 00000000.00000002.4519895828.000000000371B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTejq
Source: Zoom.exe, 00000000.00000002.4519895828.000000000371B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Zoom.exe, 00000000.00000002.4519895828.000000000371B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager*

Source: C:\Users\user\Desktop\Zoom.exe	Queries volume information: C:\Users\user\Desktop\Zoom.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Zoom.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Queries volume information: C:\Users\user\AppData\Roaming\Zoom.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Queries volume information: C:\Users\user\AppData\Roaming\Zoom.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Zoom.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Zoom.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected MicroClip

Source: Yara match

File source: Process Memory Space: Zoom.exe PID: 6496, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus Web3
Source: Zoom.exe, 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: Zoom.exe, 00000000.00000002.4533314629.00000000048B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\Zoom.exe

Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt

Jump to behavior

Source: Yara match	File source: 00000004.00000002.2363736434.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4519895828.0000000003133000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Zoom.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Zoom.exe PID: 5044, type: MEMORYSTR

Remote Access Functionality

Yara detected MicroClip

Source: Yara match

File source: Process Memory Space: Zoom.exe PID: 6496, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	321 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	531 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	341 Virtualization/Sandbox Evasion	NTDS	341 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Deobfuscate/Decode Files or Information	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	22 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Timestomp	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 DLL Side-Loading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Zoom.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
Zoom.exe