Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	June 14, 2024, 10:13 a.m.	June 14, 2024, 10:17 a.m.

Size	7.9MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`414d550d9c7fed5b71913ed7e4dd967b`
SHA256	`8537ddcdf90cfb74ec563ce669da68cb0c48bf1e9a47461dce1f9f87d8b1468c`
CRC32	`2CDB050F`
ssdeep	`98304:uvjhqgiBjlJw0PVUkEL8KyjpfmMRxUdHDcwp:x5k0dUdLYmMRxU5x`
Yara	IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library Malicious_Packer_Zero - Malicious Packer DllRegisterServer_Zero - execute regsvr32.exe UPX_Zero - UPX packed file PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

zardsystemschange.exe "C:\Users\test22\AppData\Local\Temp\zardsystemschange.exe"
2060

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
__exception__ June 14, 2024, 10:13 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 5364011488 registers.r15: 0 registers.rcx: -1 registers.rsi: 2947329 registers.r10: 3221225480 registers.rbx: -10000 registers.rsp: 2947560 registers.r11: 514 registers.r8: 2947600 registers.r9: 350 registers.rdx: 0 registers.r12: 2948128 registers.rbp: 2947624 registers.rdi: 5356058368 registers.rax: 0 registers.r13: 3822992	1	0	0

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Agent.Y!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Cylance	Unsafe
K7AntiVirus	Trojan ( 005af30d1 )
BitDefender	Trojan.GenericKD.73120414
K7GW	Trojan ( 005af30d1 )
Arcabit	Trojan.Generic.D45BBA9E
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of WinGo/TrojanDropper.Agent.CS
Avast	Win64:Malware-gen
Kaspersky	Trojan.MSIL.Agent.qwitrc
Alibaba	TrojanDropper:MSIL/Genric.403d677a
MicroWorld-eScan	Trojan.GenericKD.73120414
Rising	Trojan.Injector!1.F43F (CLASSIC)
Emsisoft	Trojan.GenericKD.73120414 (B)
F-Secure	Heuristic.HEUR/AGEN.1372589
TrendMicro	TrojanSpy.Win64.LUMMASTEALER.YXEFLZ
McAfeeD	ti!8537DDCDF90C
FireEye	Trojan.GenericKD.73120414
Sophos	Mal/Generic-S
Ikarus	Trojan.WinGo.Agent
Google	Detected
Avira	HEUR/AGEN.1372589
Antiy-AVL	Trojan/Win32.Sabsik
Kingsoft	MSIL.Trojan.Agent.qwitrc
Gridinsoft	Ransom.Win64.Sabsik.cl
Microsoft	Trojan:Win32/LummaStealer.MWW!MTB
ZoneAlarm	Trojan.MSIL.Agent.qwitrc
GData	Win64.Trojan.Agent.BEC48S
Varist	W64/ABTrojan.FTIZ-6155
AhnLab-V3	Trojan/Win.Evo-gen.C5558850
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.4098889607
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win64.LUMMASTEALER.YXEFLZ
Tencent	Msil.Trojan.Agent.Jajl
MAX	malware (ai score=89)
Fortinet	PossibleThreat.RF
AVG	Win64:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan[dropper]:Multi/Agent.CB

zardsystemschange.exe