Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 9, 2021, 6:15 p.m.	July 9, 2021, 6:28 p.m.

Size	216.1KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`86494bc0ef5f71fa7364129fa22a9a8f`
SHA256	`0c6be7aa9d02dd6545c3e18913e5a89c7cb96bfe79875c1a6c4aeea632a9c9ee`
CRC32	`6004E376`
ssdeep	`3072:hDxaVzwmg4CSW8JSuQbLG5UfH+hbf+XsFzMN/SkIwx3zxLUx+u2fF5qpirjwTeeV:xMm4CCAy5Uv+5/F7ktoUD2Cbe0Sus`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 9, 2021, 6:15 p.m.		1	1	0

section

.ndata

file	C:\Users\test22\AppData\Local\Temp\kxeaw.dll
file	C:\Users\test22\AppData\Roaming\wsqgmusokvche\vsumscogwbkjc.exe

file	C:\Users\test22\AppData\Local\Temp\kxeaw.dll
file	C:\Users\test22\AppData\Roaming\wsqgmusokvche\vsumscogwbkjc.exe

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess July 9, 2021, 6:15 p.m.	status_code: 0x00000000 process_identifier: 1772 process_handle: 0x00000214		0	0
NtTerminateProcess July 9, 2021, 6:15 p.m.	status_code: 0x00000000 process_identifier: 1772 process_handle: 0x00000214	1	0	0

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\xhnoegrknsqtsg

reg_value

C:\Users\test22\AppData\Roaming\wsqgmusokvche\vsumscogwbkjc.exe

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Zum.Androm.1
FireEye	Generic.mg.86494bc0ef5f71fa
Cybereason	malicious.0ef5f7
Cyren	W32/Injector.AIY.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EPRT
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.Win32.Stealer.gen
BitDefender	Zum.Androm.1
Emsisoft	Zum.Androm.1 (B)
McAfee-GW-Edition	BehavesLike.Win32.ICLoader.dc
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
Avira	HEUR/AGEN.1141442
Microsoft	Program:Win32/Wacapew.C!ml
GData	Zum.Androm.1
Cynet	Malicious (score: 100)
MAX	malware (ai score=83)
Fortinet	W32/Injector.EOZI!tr
CrowdStrike	win/malicious_confidence_60% (D)

startuppp.exe