URL:

https://e3.boxcdn.net/box-installers/boxedit/win/upgrades/BoxToolsInstaller-UserUpgrade-4.5.6.593.msi.zip

Full analysis: https://app.any.run/tasks/29e5dd3a-ad91-436e-b912-414091217b0e
Verdict: Malicious activity
Analysis date: July 01, 2019, 14:15:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

3CCDCBF64194ACF05366A68A6B129890

SHA1:

ADEDA12D60DB9C7BBEC1B96F36928D9A4DBB2340

SHA256:

2D845861CF30BF537330EB88FA245690DEA7B999E1359F80ECF88A7280BB096A

SSDEEP:

3:N81HKdMIR2lXVKWrmmXWRBXIwHXXdrnLYqc:2Y12lXVKWqmGTXNnd7LHc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 1040)
      • rundll32.exe (PID: 2604)
      • rundll32.exe (PID: 3892)
      • rundll32.exe (PID: 3976)
      • rundll32.exe (PID: 3252)
      • rundll32.exe (PID: 992)
      • rundll32.exe (PID: 3908)
      • rundll32.exe (PID: 3716)
      • rundll32.exe (PID: 3068)
      • Box Edit.exe (PID: 1904)
      • Box Local Com Service.exe (PID: 2356)

    • Application was dropped or rewritten from another process

      • Box Edit.exe (PID: 1904)
      • Box Local Com Service.exe (PID: 2356)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1696)
      • rundll32.exe (PID: 2604)
      • rundll32.exe (PID: 3068)
      • rundll32.exe (PID: 1040)
      • rundll32.exe (PID: 3252)
      • rundll32.exe (PID: 3908)

    • Executed as Windows Service

      • vssvc.exe (PID: 1804)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 1696)

    • Executed via COM

      • DrvInst.exe (PID: 2796)

    • Uses RUNDLL32.EXE to load library

      • MsiExec.exe (PID: 3160)

    • Creates files in the user directory

      • msiexec.exe (PID: 1696)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3984)

    • Uses WMIC.EXE to obtain a system information

      • Box Local Com Service.exe (PID: 2356)

    • Reads Environment values

      • Box Local Com Service.exe (PID: 2356)

  • INFO

    • Reads settings of System Certificates

      • chrome.exe (PID: 3984)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 1804)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 2796)

    • Application launched itself

      • msiexec.exe (PID: 1696)
      • chrome.exe (PID: 3984)

    • Manual execution by user

      • msiexec.exe (PID: 2352)

    • Searches for installed software

      • msiexec.exe (PID: 1696)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2796)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 1696)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3984)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
41
Malicious processes
9
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msiexec.exe no specs msiexec.exe vssvc.exe no specs chrome.exe no specs drvinst.exe no specs chrome.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe rundll32.exe rundll32.exe rundll32.exe no specs box edit.exe box local com service.exe wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
344"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\BoxToolsInstaller-UserUpgrade-4.5.6.593.msi.zip"C:\Program Files\WinRAR\WinRAR.exe—chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
992rundll32.exe "C:\Windows\Installer\MSI516C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1331562 215 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.CommitC:\Windows\system32\rundll32.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1040rundll32.exe "C:\Windows\Installer\MSI3AAE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1325859 167 Box.LocalComServer.Installer.CustomActions!Box.LocalComServer.Installer.CustomActions.ApplicationSettingsCustomActions.PrepareC:\Windows\system32\rundll32.exe
MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1492"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=932,15379422907693368005,9165559896744267503,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=12153753579227088745 --mojo-platform-channel-handle=3792 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1584"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=932,15379422907693368005,9165559896744267503,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=8253498065153200842 --mojo-platform-channel-handle=4032 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1656"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=932,15379422907693368005,9165559896744267503,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=66203899630775436 --mojo-platform-channel-handle=960 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1696C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1804C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1892"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=932,15379422907693368005,9165559896744267503,131072 --enable-features=PasswordImport --service-pipe-token=6540198023234917099 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6540198023234917099 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\73.0.3683.75\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1904"C:\Users\admin\AppData\Local\Box\Box Edit\Box Edit.exe"C:\Users\admin\AppData\Local\Box\Box Edit\Box Edit.exe
msiexec.exe
User:
admin
Company:
Box, Inc.
Integrity Level:
MEDIUM
Description:
Box Edit
Exit code:
0
Version:
4.5.6.593
Modules
Images
c:\users\admin\appdata\local\box\box edit\box edit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
2 234
Read events
1 683
Write events
535
Delete events
16

Modification events

(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2492) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3984-13206464145661125
Value:
259
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3984) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3488-13197474229333984
Value:
0
(PID) Process:(3984) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
76
Suspicious files
31
Text files
323
Unknown types
10

Dropped files

PID
Process
Filename
Type
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\f83d95c4-d131-4416-aa73-a5e425c33f4d.tmp —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1 —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2 —
MD5:—
SHA256:—
3984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
23
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3984
chrome.exe
GET
204
172.217.16.131:80
http://www.gstatic.com/generate_204
US
—
—
whitelisted
3984
chrome.exe
GET
302
172.217.18.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
511 b
whitelisted
3984
chrome.exe
GET
200
87.245.198.16:80
http://r5---sn-gxuog0-axqe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjJlQUFXRC12Ny1ldUFnMXF3SDlXZDlFZw/7319.128.0.1_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.117.118.92&mm=28&mn=sn-gxuog0-axqe&ms=nvh&mt=1561990407&mv=m&pl=24&shardbypass=yes
RU
crx
842 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3984
chrome.exe
172.217.18.13:443
accounts.google.com
Google Inc.
US
whitelisted
3984
chrome.exe
172.217.22.99:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3984
chrome.exe
104.111.218.103:443
e3.boxcdn.net
Akamai International B.V.
NL
whitelisted
3984
chrome.exe
172.217.18.3:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3984
chrome.exe
172.217.16.129:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
3984
chrome.exe
172.217.18.110:80
redirector.gvt1.com
Google Inc.
US
whitelisted
3984
chrome.exe
172.217.16.131:80
www.gstatic.com
Google Inc.
US
whitelisted
3984
chrome.exe
87.245.198.16:80
r5---sn-gxuog0-axqe.gvt1.com
RETN Limited
RU
whitelisted
1904
Box Edit.exe
185.235.236.197:443
api.box.com
—
—
suspicious
3984
chrome.exe
216.58.205.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.22.99
whitelisted
e3.boxcdn.net
  • 104.111.218.103
unknown
accounts.google.com
  • 172.217.18.13
shared
www.google.com
  • 172.217.23.132
malicious
ssl.gstatic.com
  • 172.217.18.3
whitelisted
www.gstatic.com
  • 172.217.16.131
whitelisted
clients2.google.com
  • 172.217.16.206
whitelisted
clients2.googleusercontent.com
  • 172.217.16.129
whitelisted
redirector.gvt1.com
  • 172.217.18.110
whitelisted
r5---sn-gxuog0-axqe.gvt1.com
  • 87.245.198.16
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://e3.boxcdn.net/box-installers/boxedit/win/upgrades/BoxToolsInstaller-UserUpgrade-4.5.6.593.msi.zip