File name:

514.1589_byond.exe

Full analysis: https://app.any.run/tasks/f332c958-c1d4-416f-9af2-5235e68a4108
Verdict: Malicious activity
Analysis date: March 05, 2024, 16:23:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

63B53B30CE9E3783724A1EF8B4249CBC

SHA1:

BA48C8213AFF8AF19EA7CFF1BD1EF120C9DB2872

SHA256:

0C05D274ED4DB7F1B110F0A7AC2CB79E813298B4542CCBEF60747AAE133EA1D0

SSDEEP:

98304:gnQx98dlMqwUxdF4thzaVQd/+yQp9DhMttPhphldMxUNyI2mGtwEfOehMoijZecI:N3Je+gp4PO9heWLnIMpPEKvqTa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)

    • Registers / Runs the DLL via REGSVR32.EXE

      • 514.1589_byond.exe (PID: 1776)

    • Creates a writable file in the system directory

      • DXSETUP.exe (PID: 2120)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 514.1589_byond.exe (PID: 3864)
      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 514.1589_byond.exe (PID: 1776)

    • The process drops C-runtime libraries

      • 514.1589_byond.exe (PID: 1776)

    • The process creates files with name similar to system file names

      • 514.1589_byond.exe (PID: 1776)

    • Starts application with an unusual extension

      • 514.1589_byond.exe (PID: 1776)

    • Process drops legitimate windows executable

      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2648)

    • Searches for installed software

      • dllhost.exe (PID: 956)
      • DXSETUP.exe (PID: 2120)

    • Reads security settings of Internet Explorer

      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)
      • 514.1589_byond.exe (PID: 1776)

    • Reads settings of System Certificates

      • DXSETUP.exe (PID: 2120)

    • Checks Windows Trust Settings

      • DXSETUP.exe (PID: 2120)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1336)

    • Reads the Internet Settings

      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Creates a software uninstall entry

      • 514.1589_byond.exe (PID: 1776)

    • Reads Microsoft Outlook installation path

      • byond.exe (PID: 880)

    • Reads Internet Explorer settings

      • byond.exe (PID: 880)

    • Application launched itself

      • 514.1589_byond.exe (PID: 3864)

  • INFO

    • Reads the computer name

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Create files in a temporary directory

      • 514.1589_byond.exe (PID: 3864)
      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Checks supported languages

      • 514.1589_byond.exe (PID: 3864)
      • ns5AC0.tmp (PID: 4060)
      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)
      • 514.1589_byond.exe (PID: 1776)

    • Reads the machine GUID from the registry

      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)

    • Reads the software policy settings

      • DXSETUP.exe (PID: 2120)

    • Creates files or folders in the user directory

      • byond.exe (PID: 880)

    • Checks proxy server information

      • byond.exe (PID: 880)

    • Creates files in the program directory

      • 514.1589_byond.exe (PID: 1776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 21:50:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x32bf
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.0.514.1589
ProductVersionNumber: 5.0.514.1589
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: BYOND Software
FileDescription: BYOND Installer
FileVersion: 5.0.514.1589
LegalCopyright: © 2022 BYOND Software
ProductName: BYOND Installer
ProductVersion: 5.0.514.1589 (5.0 Public)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 514.1589_byond.exe 514.1589_byond.exe ns5ac0.tmp no specs dxsetup.exe vssvc.exe no specs SPPSurrogate no specs regsvr32.exe no specs byond.exe

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Program Files\BYOND\bin\byond.exe" C:\Program Files\BYOND\bin\byond.exe
514.1589_byond.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
BYOND
Exit code:
0
Version:
5.0.514.1589
Modules
Images
c:\program files\byond\bin\byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\byond\bin\byondwin.dll
c:\program files\byond\bin\byondcore.dll
c:\program files\byond\bin\byondext.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
956C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1336regsvr32 /s /c "C:\Program Files\BYOND\bin\byondstub.dll"C:\Windows\System32\regsvr32.exe—514.1589_byond.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1776"C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe" /UAC:12019C /NCRC C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe
514.1589_byond.exe
User:
admin
Company:
BYOND Software
Integrity Level:
HIGH
Description:
BYOND Installer
Exit code:
1223
Version:
5.0.514.1589
Modules
Images
c:\users\admin\appdata\local\temp\514.1589_byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2120"C:\Program Files\BYOND\directx\DXSETUP.exe" /silentC:\Program Files\BYOND\directx\DXSETUP.exe
ns5AC0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft DirectX Setup
Exit code:
0
Version:
4.9.0.0904
Modules
Images
c:\program files\byond\directx\dxsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2648C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3864"C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe" C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe
explorer.exe
User:
admin
Company:
BYOND Software
Integrity Level:
MEDIUM
Description:
BYOND Installer
Exit code:
1223
Version:
5.0.514.1589
Modules
Images
c:\users\admin\appdata\local\temp\514.1589_byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
4060"C:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ns5AC0.tmp" "C:\Program Files\BYOND\directx\DXSETUP.exe" /silentC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ns5AC0.tmp—514.1589_byond.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nswf89a.tmp\ns5ac0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
12 519
Read events
12 273
Write events
234
Delete events
12

Modification events

(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX
Operation:writeName:command
Value:
0
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX
Operation:writeName:DXSetup
Value:
0
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000001127E681196FDA0148080000A80F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000006B89E881196FDA0148080000A80F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000087D7F681196FDA0148080000A80F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000095FEFD81196FDA0148080000780F0000E8030000010000000000000000000000682653967C4416459CACE4356478BB850000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000B8080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000F4080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000500B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
38
Suspicious files
40
Text files
115
Unknown types
5

Dropped files

PID
Process
Filename
Type
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\modern-wizard.bmpimage
MD5:A3FC51B1BD19974E46DB7B52F90FF5BC
SHA256:67A4B5579F6E751159BAD822DA105858B68F4080E5F430B79EE1B9BD4AC05040
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\spltmp.bmpimage
MD5:E0F5E79C3FCDB02DBD645E70AE9F0661
SHA256:CC8A70AC324F641536677BFCA9D7BF0699E5741BF0661D770C9C0640526372FB
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\modern-header.bmpimage
MD5:044093109EBEF3C866A65A435010BAAB
SHA256:26B00AA88EDFB27DFD208394B81AF4E909D28EF5219A31380C3FBDEDDEF0E112
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\advsplash.dllexecutable
MD5:15D8EEE287329E2030C34C6BB3E62C87
SHA256:9BF33690090655E91389469BEB5DBDD45942192F2E2486C9FA82FA6D74A0F88B
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\nsProcessBYOND.dllexecutable
MD5:7B6CBDE5DA4391FE1B59B5E66E1A8507
SHA256:A54E0DF29E251120CEB49D05E9977950F5B25B873E6222672EEECB100BCBB4A2
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\UAC.dllexecutable
MD5:4814167AA1C7EC892E84907094646FAA
SHA256:32DD7269ABF5A0E5DB888E307D9DF313E87CEF4F1B597965A9D8E00934658822
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\System.dllexecutable
MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\UserInfo.dllexecutable
MD5:C22C9D7B6937B8960FBA4C8A145076B2
SHA256:510E466A715933499FB9D5A1753B483826B2BF89161B9D466DD2AD7E52EDE2FC
1776514.1589_byond.exeC:\Program Files\12345.tmpbinary
MD5:93B885ADFE0DA089CDF634904FD59F71
SHA256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
byond.exe
GET
—
172.67.180.70:80
http://www.byond.com/HubPorts
unknown
—
—
unknown
880
byond.exe
GET
—
172.67.180.70:80
http://www.byond.com/rsc/hubcache.js?1709640000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
880
byond.exe
172.67.180.70:80
www.byond.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
www.byond.com
  • 172.67.180.70
unknown

Threats

No threats detected
Process
Message
DXSETUP.exe
DLL_PROCESS_ATTACH
DXSETUP.exe
DLL_PROCESS_ATTACH
DXSETUP.exe
DLL_PROCESS_DETACH
DXSETUP.exe
DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
514.1589_byond.exe