Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 2, 2021, 7:48 a.m.	June 2, 2021, 7:50 a.m.

Size	124.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`616f7519c2af317844666eab115e219f`
SHA256	`f40a3110a2395ca91170fa53db91fef3b9973ad85151eacca3e0b11a02fa2570`
CRC32	`340097DF`
ssdeep	`1536:6IegipDQlK8h54PwBxO5zPZRRXwoErVBD2e0fAzOStPjPG:VHflv5fxOpxvA15C4zj1PG`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

FNH.exe "C:\Users\test22\AppData\Local\Temp\FNH.exe"
3588

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 2, 2021, 7:48 a.m.	stacktrace: waveInPrepareHeader+0x3a waveInUnprepareHeader-0x33 winmm+0x25aa4 @ 0x71fa5aa4 fnh+0x1abcb @ 0x41abcb fnh+0x10bd5 @ 0x410bd5 IID_IVbaHost+0x236f3 UserDllMain-0x41bc4 msvbvm60+0x51d33 @ 0x72991d33 fnh+0x2264 @ 0x402264 IID_IVbaHost+0x239f4 UserDllMain-0x418c3 msvbvm60+0x52034 @ 0x72992034 IID_IVbaHost+0x23e5b UserDllMain-0x4145c msvbvm60+0x5249b @ 0x7299249b IID_IVbaHost+0x24027 UserDllMain-0x41290 msvbvm60+0x52667 @ 0x72992667 IID_IVbaHost+0x3b77 UserDllMain-0x61740 msvbvm60+0x321b7 @ 0x729721b7 IID_IVbaHost+0x386d UserDllMain-0x61a4a msvbvm60+0x31ead @ 0x72971ead IID_IVbaHost+0x36291 UserDllMain-0x2f026 msvbvm60+0x648d1 @ 0x729a48d1 IID_IVbaHost+0x418d8 UserDllMain-0x239df msvbvm60+0x6ff18 @ 0x729aff18 BASIC_CLASS_Release+0xfcaa IID_IVbaHost-0xff3d msvbvm60+0x1e703 @ 0x7295e703 BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 fnh+0x167a @ 0x40167a RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 8b 40 d4 33 c9 3b 45 0c 0f 94 c1 8b c1 5d c2 08 exception.instruction: mov eax, dword ptr [eax + 0xffffffd4] exception.exception_code: 0xc0000005 exception.symbol: DriverCallback+0x7bc waveOutOpen-0x2c0 winmm+0x425e exception.address: 0x71f8425e registers.esp: 1636284 registers.edi: 1636440 registers.eax: 8243192 registers.ebp: 1636284 registers.edx: 0 registers.ebx: 0 registers.esi: 1636408 registers.ecx: 1912247388	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 2, 2021, 7:48 a.m.

stacktrace:

waveInPrepareHeader+0x3a waveInUnprepareHeader-0x33 winmm+0x25aa4 @ 0x71fa5aa4
fnh+0x1abcb @ 0x41abcb
fnh+0x10bd5 @ 0x410bd5
IID_IVbaHost+0x236f3 UserDllMain-0x41bc4 msvbvm60+0x51d33 @ 0x72991d33
fnh+0x2264 @ 0x402264
IID_IVbaHost+0x239f4 UserDllMain-0x418c3 msvbvm60+0x52034 @ 0x72992034
IID_IVbaHost+0x23e5b UserDllMain-0x4145c msvbvm60+0x5249b @ 0x7299249b
IID_IVbaHost+0x24027 UserDllMain-0x41290 msvbvm60+0x52667 @ 0x72992667
IID_IVbaHost+0x3b77 UserDllMain-0x61740 msvbvm60+0x321b7 @ 0x729721b7
IID_IVbaHost+0x386d UserDllMain-0x61a4a msvbvm60+0x31ead @ 0x72971ead
IID_IVbaHost+0x36291 UserDllMain-0x2f026 msvbvm60+0x648d1 @ 0x729a48d1
IID_IVbaHost+0x418d8 UserDllMain-0x239df msvbvm60+0x6ff18 @ 0x729aff18
BASIC_CLASS_Release+0xfcaa IID_IVbaHost-0xff3d msvbvm60+0x1e703 @ 0x7295e703
BASIC_CLASS_QueryInterface+0xeca EbLoadRunTime-0x13a4 msvbvm60+0x7b3e @ 0x72947b3e
ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981
ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa
ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600
fnh+0x167a @ 0x40167a
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 8b 40 d4 33 c9 3b 45 0c 0f 94 c1 8b c1 5d c2 08
exception.instruction: mov eax, dword ptr [eax + 0xffffffd4]
exception.exception_code: 0xc0000005
exception.symbol: DriverCallback+0x7bc waveOutOpen-0x2c0 winmm+0x425e
exception.address: 0x71f8425e
registers.esp: 1636284
registers.edi: 1636440
registers.eax: 8243192
registers.ebp: 1636284
registers.edx: 0
registers.ebx: 0
registers.esi: 1636408
registers.ecx: 1912247388

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 2, 2021, 7:48 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 2, 2021, 7:48 a.m.	process_identifier: 3588 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
FireEye	Generic.mg.616f7519c2af3178
Sangfor	Trojan.Win32.Save.a
BitDefenderTheta	Gen:NN.ZevbaCO.34692.hm0@a8Xn59di
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.MSIL.Crypt.htzb
Ikarus	Trojan-Downloader.Win32.GuLoader
GData	Win32.Trojan-Downloader.GuLoader.DCPI63
AhnLab-V3	Trojan/Win32.Fareit.C2420319
Yandex	Trojan.AvsArher.bTx33N
Fortinet	W32/Crypt.HTZB!tr
CrowdStrike	win/malicious_confidence_60% (W)

FNH.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All