File name:

514.1589_byond.exe

Full analysis: https://app.any.run/tasks/f332c958-c1d4-416f-9af2-5235e68a4108
Verdict: Malicious activity
Analysis date: March 05, 2024, 16:23:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

63B53B30CE9E3783724A1EF8B4249CBC

SHA1:

BA48C8213AFF8AF19EA7CFF1BD1EF120C9DB2872

SHA256:

0C05D274ED4DB7F1B110F0A7AC2CB79E813298B4542CCBEF60747AAE133EA1D0

SSDEEP:

98304:gnQx98dlMqwUxdF4thzaVQd/+yQp9DhMttPhphldMxUNyI2mGtwEfOehMoijZecI:N3Je+gp4PO9heWLnIMpPEKvqTa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)

    • Registers / Runs the DLL via REGSVR32.EXE

      • 514.1589_byond.exe (PID: 1776)

    • Creates a writable file in the system directory

      • DXSETUP.exe (PID: 2120)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 514.1589_byond.exe (PID: 1776)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 514.1589_byond.exe (PID: 1776)

    • The process creates files with name similar to system file names

      • 514.1589_byond.exe (PID: 1776)

    • Starts application with an unusual extension

      • 514.1589_byond.exe (PID: 1776)

    • Process drops legitimate windows executable

      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Executable content was dropped or overwritten

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)

    • Application launched itself

      • 514.1589_byond.exe (PID: 3864)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2648)

    • Searches for installed software

      • dllhost.exe (PID: 956)
      • DXSETUP.exe (PID: 2120)

    • Reads security settings of Internet Explorer

      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Reads settings of System Certificates

      • DXSETUP.exe (PID: 2120)

    • Checks Windows Trust Settings

      • DXSETUP.exe (PID: 2120)

    • Creates a software uninstall entry

      • 514.1589_byond.exe (PID: 1776)

    • Reads the Internet Settings

      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1336)

    • Reads Internet Explorer settings

      • byond.exe (PID: 880)

    • Reads Microsoft Outlook installation path

      • byond.exe (PID: 880)

  • INFO

    • Reads the computer name

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)
      • 514.1589_byond.exe (PID: 1776)

    • Create files in a temporary directory

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)

    • Checks supported languages

      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • ns5AC0.tmp (PID: 4060)
      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Reads the machine GUID from the registry

      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)

    • Reads the software policy settings

      • DXSETUP.exe (PID: 2120)

    • Creates files or folders in the user directory

      • byond.exe (PID: 880)

    • Checks proxy server information

      • byond.exe (PID: 880)

    • Creates files in the program directory

      • 514.1589_byond.exe (PID: 1776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 21:50:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x32bf
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.0.514.1589
ProductVersionNumber: 5.0.514.1589
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: BYOND Software
FileDescription: BYOND Installer
FileVersion: 5.0.514.1589
LegalCopyright: © 2022 BYOND Software
ProductName: BYOND Installer
ProductVersion: 5.0.514.1589 (5.0 Public)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 514.1589_byond.exe 514.1589_byond.exe ns5ac0.tmp no specs dxsetup.exe vssvc.exe no specs SPPSurrogate no specs regsvr32.exe no specs byond.exe

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Program Files\BYOND\bin\byond.exe" C:\Program Files\BYOND\bin\byond.exe
514.1589_byond.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
BYOND
Exit code:
0
Version:
5.0.514.1589
Modules
Images
c:\program files\byond\bin\byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\byond\bin\byondwin.dll
c:\program files\byond\bin\byondcore.dll
c:\program files\byond\bin\byondext.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
956C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1336regsvr32 /s /c "C:\Program Files\BYOND\bin\byondstub.dll"C:\Windows\System32\regsvr32.exe—514.1589_byond.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1776"C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe" /UAC:12019C /NCRC C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe
514.1589_byond.exe
User:
admin
Company:
BYOND Software
Integrity Level:
HIGH
Description:
BYOND Installer
Exit code:
1223
Version:
5.0.514.1589
Modules
Images
c:\users\admin\appdata\local\temp\514.1589_byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2120"C:\Program Files\BYOND\directx\DXSETUP.exe" /silentC:\Program Files\BYOND\directx\DXSETUP.exe
ns5AC0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft DirectX Setup
Exit code:
0
Version:
4.9.0.0904
Modules
Images
c:\program files\byond\directx\dxsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2648C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3864"C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe" C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe
explorer.exe
User:
admin
Company:
BYOND Software
Integrity Level:
MEDIUM
Description:
BYOND Installer
Exit code:
1223
Version:
5.0.514.1589
Modules
Images
c:\users\admin\appdata\local\temp\514.1589_byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
4060"C:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ns5AC0.tmp" "C:\Program Files\BYOND\directx\DXSETUP.exe" /silentC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ns5AC0.tmp—514.1589_byond.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nswf89a.tmp\ns5ac0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
12 519
Read events
12 273
Write events
234
Delete events
12

Modification events

(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX
Operation:writeName:command
Value:
0
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX
Operation:writeName:DXSetup
Value:
0
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000001127E681196FDA0148080000A80F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000006B89E881196FDA0148080000A80F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000087D7F681196FDA0148080000A80F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000095FEFD81196FDA0148080000780F0000E8030000010000000000000000000000682653967C4416459CACE4356478BB850000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000B8080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000F4080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000500B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
38
Suspicious files
40
Text files
115
Unknown types
5

Dropped files

PID
Process
Filename
Type
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\UAC.dllexecutable
MD5:4814167AA1C7EC892E84907094646FAA
SHA256:32DD7269ABF5A0E5DB888E307D9DF313E87CEF4F1B597965A9D8E00934658822
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\spltmp.bmpimage
MD5:E0F5E79C3FCDB02DBD645E70AE9F0661
SHA256:CC8A70AC324F641536677BFCA9D7BF0699E5741BF0661D770C9C0640526372FB
3864514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nsbF781.tmp\UAC.dllexecutable
MD5:4814167AA1C7EC892E84907094646FAA
SHA256:32DD7269ABF5A0E5DB888E307D9DF313E87CEF4F1B597965A9D8E00934658822
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\System.dllexecutable
MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
1776514.1589_byond.exeC:\Program Files\12345.tmpbinary
MD5:93B885ADFE0DA089CDF634904FD59F71
SHA256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
1776514.1589_byond.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\BYOND\Dream Daemon.lnkbinary
MD5:AE71A58B57DE79DBE63B19DF9C2E036B
SHA256:918A3460859336145163671542BBF7FD169484DC094B9F1FFA8F524A630BCA15
1776514.1589_byond.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\BYOND\BYOND.lnklnk
MD5:A810FD648E9D59D522ACEAF94BEFA3D6
SHA256:4502E8398CE6BCE9D5ED48F1C7C86B7C32B2C20876AE28611BFB8BC4A0B9ADF3
1776514.1589_byond.exeC:\Users\Public\Desktop\BYOND.lnklnk
MD5:3AFD4BF1D183FFAD557E795B2653C213
SHA256:2660EA793966A30654329949628255128FF5F91233ECEB144F98254066D95082
1776514.1589_byond.exeC:\Program Files\BYOND\bin\byond.exeexecutable
MD5:64D336E4F61EB61968B9A04E8D95A799
SHA256:39C10C059ED6564FA82B3F207709D124B8159949CB774BFF01B86CE9D0C642AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
byond.exe
GET
—
172.67.180.70:80
http://www.byond.com/HubPorts
unknown
—
—
unknown
880
byond.exe
GET
—
172.67.180.70:80
http://www.byond.com/rsc/hubcache.js?1709640000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
880
byond.exe
172.67.180.70:80
www.byond.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
www.byond.com
  • 172.67.180.70
unknown

Threats

No threats detected
Process
Message
DXSETUP.exe
DLL_PROCESS_ATTACH
DXSETUP.exe
DLL_PROCESS_ATTACH
DXSETUP.exe
DLL_PROCESS_DETACH
DXSETUP.exe
DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
514.1589_byond.exe