File name:

514.1589_byond.exe

Full analysis: https://app.any.run/tasks/f332c958-c1d4-416f-9af2-5235e68a4108
Verdict: Malicious activity
Analysis date: March 05, 2024, 16:23:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

63B53B30CE9E3783724A1EF8B4249CBC

SHA1:

BA48C8213AFF8AF19EA7CFF1BD1EF120C9DB2872

SHA256:

0C05D274ED4DB7F1B110F0A7AC2CB79E813298B4542CCBEF60747AAE133EA1D0

SSDEEP:

98304:gnQx98dlMqwUxdF4thzaVQd/+yQp9DhMttPhphldMxUNyI2mGtwEfOehMoijZecI:N3Je+gp4PO9heWLnIMpPEKvqTa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 514.1589_byond.exe (PID: 3864)
      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Creates a writable file in the system directory

      • DXSETUP.exe (PID: 2120)

    • Registers / Runs the DLL via REGSVR32.EXE

      • 514.1589_byond.exe (PID: 1776)

  • SUSPICIOUS

    • Application launched itself

      • 514.1589_byond.exe (PID: 3864)

    • Executable content was dropped or overwritten

      • 514.1589_byond.exe (PID: 3864)
      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 514.1589_byond.exe (PID: 1776)

    • The process creates files with name similar to system file names

      • 514.1589_byond.exe (PID: 1776)

    • The process drops C-runtime libraries

      • 514.1589_byond.exe (PID: 1776)

    • Process drops legitimate windows executable

      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Starts application with an unusual extension

      • 514.1589_byond.exe (PID: 1776)

    • Searches for installed software

      • dllhost.exe (PID: 956)
      • DXSETUP.exe (PID: 2120)

    • Checks Windows Trust Settings

      • DXSETUP.exe (PID: 2120)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2648)

    • Reads security settings of Internet Explorer

      • DXSETUP.exe (PID: 2120)
      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Reads settings of System Certificates

      • DXSETUP.exe (PID: 2120)

    • Creates a software uninstall entry

      • 514.1589_byond.exe (PID: 1776)

    • Reads the Internet Settings

      • 514.1589_byond.exe (PID: 1776)
      • byond.exe (PID: 880)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1336)

    • Reads Microsoft Outlook installation path

      • byond.exe (PID: 880)

    • Reads Internet Explorer settings

      • byond.exe (PID: 880)

  • INFO

    • Reads the computer name

      • 514.1589_byond.exe (PID: 1776)
      • 514.1589_byond.exe (PID: 3864)
      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)

    • Checks supported languages

      • 514.1589_byond.exe (PID: 3864)
      • 514.1589_byond.exe (PID: 1776)
      • ns5AC0.tmp (PID: 4060)
      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)

    • Create files in a temporary directory

      • 514.1589_byond.exe (PID: 3864)
      • 514.1589_byond.exe (PID: 1776)
      • DXSETUP.exe (PID: 2120)

    • Creates files in the program directory

      • 514.1589_byond.exe (PID: 1776)

    • Reads the machine GUID from the registry

      • DXSETUP.exe (PID: 2120)
      • byond.exe (PID: 880)

    • Reads the software policy settings

      • DXSETUP.exe (PID: 2120)

    • Creates files or folders in the user directory

      • byond.exe (PID: 880)

    • Checks proxy server information

      • byond.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 21:50:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 118784
UninitializedDataSize: 1024
EntryPoint: 0x32bf
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.0.514.1589
ProductVersionNumber: 5.0.514.1589
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: BYOND Software
FileDescription: BYOND Installer
FileVersion: 5.0.514.1589
LegalCopyright: © 2022 BYOND Software
ProductName: BYOND Installer
ProductVersion: 5.0.514.1589 (5.0 Public)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
8
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 514.1589_byond.exe 514.1589_byond.exe ns5ac0.tmp no specs dxsetup.exe vssvc.exe no specs SPPSurrogate no specs regsvr32.exe no specs byond.exe

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Program Files\BYOND\bin\byond.exe" C:\Program Files\BYOND\bin\byond.exe
514.1589_byond.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
BYOND
Exit code:
0
Version:
5.0.514.1589
Modules
Images
c:\program files\byond\bin\byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\byond\bin\byondwin.dll
c:\program files\byond\bin\byondcore.dll
c:\program files\byond\bin\byondext.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
956C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1336regsvr32 /s /c "C:\Program Files\BYOND\bin\byondstub.dll"C:\Windows\System32\regsvr32.exe—514.1589_byond.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1776"C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe" /UAC:12019C /NCRC C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe
514.1589_byond.exe
User:
admin
Company:
BYOND Software
Integrity Level:
HIGH
Description:
BYOND Installer
Exit code:
1223
Version:
5.0.514.1589
Modules
Images
c:\users\admin\appdata\local\temp\514.1589_byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2120"C:\Program Files\BYOND\directx\DXSETUP.exe" /silentC:\Program Files\BYOND\directx\DXSETUP.exe
ns5AC0.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft DirectX Setup
Exit code:
0
Version:
4.9.0.0904
Modules
Images
c:\program files\byond\directx\dxsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2648C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3864"C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe" C:\Users\admin\AppData\Local\Temp\514.1589_byond.exe
explorer.exe
User:
admin
Company:
BYOND Software
Integrity Level:
MEDIUM
Description:
BYOND Installer
Exit code:
1223
Version:
5.0.514.1589
Modules
Images
c:\users\admin\appdata\local\temp\514.1589_byond.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
4060"C:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ns5AC0.tmp" "C:\Program Files\BYOND\directx\DXSETUP.exe" /silentC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ns5AC0.tmp—514.1589_byond.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nswf89a.tmp\ns5ac0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
12 519
Read events
12 273
Write events
234
Delete events
12

Modification events

(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX
Operation:writeName:command
Value:
0
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX
Operation:writeName:DXSetup
Value:
0
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000001127E681196FDA0148080000A80F0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000006B89E881196FDA0148080000A80F0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000087D7F681196FDA0148080000A80F0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2120) DXSETUP.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000095FEFD81196FDA0148080000780F0000E8030000010000000000000000000000682653967C4416459CACE4356478BB850000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000B8080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000F4080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2648) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000A3250582196FDA01580A0000500B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
38
Suspicious files
40
Text files
115
Unknown types
5

Dropped files

PID
Process
Filename
Type
1776514.1589_byond.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\BYOND\Uninstall BYOND.lnklnk
MD5:2D8D877922CCE06D293CBF939369D62F
SHA256:59075BB340526D73FD5626BE1B934C2C2F2A28E69F97E4BDA7A9477BB4D89262
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\spltmp.bmpimage
MD5:E0F5E79C3FCDB02DBD645E70AE9F0661
SHA256:CC8A70AC324F641536677BFCA9D7BF0699E5741BF0661D770C9C0640526372FB
1776514.1589_byond.exeC:\Program Files\12345.tmpbinary
MD5:93B885ADFE0DA089CDF634904FD59F71
SHA256:6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\UserInfo.dllexecutable
MD5:C22C9D7B6937B8960FBA4C8A145076B2
SHA256:510E466A715933499FB9D5A1753B483826B2BF89161B9D466DD2AD7E52EDE2FC
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\modern-wizard.bmpimage
MD5:A3FC51B1BD19974E46DB7B52F90FF5BC
SHA256:67A4B5579F6E751159BAD822DA105858B68F4080E5F430B79EE1B9BD4AC05040
1776514.1589_byond.exeC:\Program Files\BYOND\bin\byondcore.dllexecutable
MD5:E7D95D3D8B6B3CA1DEB7610DA79BA9C8
SHA256:DCC1972D41BA81E742EC6D9EC915AE8F05CDDCBF4FD8DBB403FAE9A026291BBF
1776514.1589_byond.exeC:\Users\admin\AppData\Local\Temp\nswF89A.tmp\modern-header.bmpimage
MD5:044093109EBEF3C866A65A435010BAAB
SHA256:26B00AA88EDFB27DFD208394B81AF4E909D28EF5219A31380C3FBDEDDEF0E112
1776514.1589_byond.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\BYOND\Dream Daemon.lnkbinary
MD5:AE71A58B57DE79DBE63B19DF9C2E036B
SHA256:918A3460859336145163671542BBF7FD169484DC094B9F1FFA8F524A630BCA15
1776514.1589_byond.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\BYOND\BYOND.lnklnk
MD5:A810FD648E9D59D522ACEAF94BEFA3D6
SHA256:4502E8398CE6BCE9D5ED48F1C7C86B7C32B2C20876AE28611BFB8BC4A0B9ADF3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
byond.exe
GET
—
172.67.180.70:80
http://www.byond.com/HubPorts
US
—
—
unknown
880
byond.exe
GET
—
172.67.180.70:80
http://www.byond.com/rsc/hubcache.js?1709640000
US
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
880
byond.exe
172.67.180.70:80
www.byond.com
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
www.byond.com
  • 172.67.180.70
unknown

Threats

No threats detected
Process
Message
DXSETUP.exe
DLL_PROCESS_ATTACH
DXSETUP.exe
DLL_PROCESS_ATTACH
DXSETUP.exe
DLL_PROCESS_DETACH
DXSETUP.exe
DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
514.1589_byond.exe