File name:

funfile.exe

Full analysis: https://app.any.run/tasks/3f8f14e8-bbc2-4ecd-a7ce-b58c76a3ff5a
Verdict: Malicious activity
Analysis date: January 30, 2024, 14:26:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
tofsee
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C55926718A5499D45CAAC73A5EA70FD6

SHA1:

B6AC96AFC925A9BBB9B7074CB5745BA757FA48FC

SHA256:

70B0E86799997E6CEB03FCF94CD82224644A6C7057CCE462B6A850A8424EF5D6

SSDEEP:

1536:6u2YZ9FOnXwyrwHnaWuWROZz47GdNohR6wQ72jPsz4UnhbGG4iPmhU:f2YZOnXwywHaWuiO54USRgGG4iuO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • funfile.exe (PID: 268)
      • bfwacjnx.exe (PID: 3372)

    • Changes the autorun value in the registry

      • funfile.exe (PID: 2768)
      • bfwacjnx.exe (PID: 3372)

    • TOFSEE has been detected (YARA)

      • svchost.exe (PID: 3688)

  • SUSPICIOUS

    • Application launched itself

      • funfile.exe (PID: 268)
      • bfwacjnx.exe (PID: 2204)
      • funfile.exe (PID: 584)
      • eizdfmqa.exe (PID: 3524)
      • gkbfhosc.exe (PID: 3576)

    • Starts CMD.EXE for commands execution

      • funfile.exe (PID: 1344)
      • funfile.exe (PID: 2768)
      • bfwacjnx.exe (PID: 3372)
      • eizdfmqa.exe (PID: 560)

    • Reads the Internet Settings

      • funfile.exe (PID: 1344)
      • funfile.exe (PID: 2768)
      • eizdfmqa.exe (PID: 560)
      • bfwacjnx.exe (PID: 3372)

    • Executing commands from a ".bat" file

      • funfile.exe (PID: 1344)
      • funfile.exe (PID: 2768)
      • bfwacjnx.exe (PID: 3372)
      • eizdfmqa.exe (PID: 560)

    • Executable content was dropped or overwritten

      • bfwacjnx.exe (PID: 3372)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 3688)

  • INFO

    • Checks supported languages

      • funfile.exe (PID: 268)
      • wmpnscfg.exe (PID: 2736)
      • funfile.exe (PID: 584)
      • funfile.exe (PID: 1344)
      • bfwacjnx.exe (PID: 2204)
      • eizdfmqa.exe (PID: 3524)
      • funfile.exe (PID: 2768)
      • bfwacjnx.exe (PID: 3372)
      • eizdfmqa.exe (PID: 560)
      • gkbfhosc.exe (PID: 3576)
      • gkbfhosc.exe (PID: 3816)

    • Reads the machine GUID from the registry

      • funfile.exe (PID: 268)
      • funfile.exe (PID: 584)
      • bfwacjnx.exe (PID: 2204)
      • eizdfmqa.exe (PID: 3524)
      • gkbfhosc.exe (PID: 3576)

    • Create files in a temporary directory

      • funfile.exe (PID: 268)
      • funfile.exe (PID: 584)
      • funfile.exe (PID: 1344)
      • bfwacjnx.exe (PID: 2204)
      • funfile.exe (PID: 2768)
      • eizdfmqa.exe (PID: 3524)
      • bfwacjnx.exe (PID: 3372)
      • gkbfhosc.exe (PID: 3576)
      • eizdfmqa.exe (PID: 560)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2736)
      • funfile.exe (PID: 584)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2736)
      • funfile.exe (PID: 1344)
      • funfile.exe (PID: 2768)
      • bfwacjnx.exe (PID: 3372)
      • eizdfmqa.exe (PID: 560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2014:06:08 05:16:52+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 118784
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x1178
OSVersion: 4
ImageVersion: 2.8
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.8.0.7
ProductVersionNumber: 2.8.0.7
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Telerik
ProductName: Bohnenmaschine
FileVersion: 2.08.0007
ProductVersion: 2.08.0007
InternalName: D
OriginalFileName: D.exe
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
21
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start funfile.exe no specs wmpnscfg.exe no specs funfile.exe no specs funfile.exe no specs bfwacjnx.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs funfile.exe ping.exe no specs eizdfmqa.exe no specs cmd.exe no specs bfwacjnx.exe gkbfhosc.exe no specs cmd.exe no specs eizdfmqa.exe no specs cmd.exe no specs gkbfhosc.exe no specs #TOFSEE svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\Desktop\funfile.exe" C:\Users\admin\Desktop\funfile.exe—explorer.exe
User:
admin
Company:
Telerik
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.08.0007
Modules
Images
c:\users\admin\desktop\funfile.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
560"C:\Users\admin\eizdfmqa.exe"C:\Users\admin\eizdfmqa.exe—eizdfmqa.exe
User:
admin
Company:
Telerik
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.08.0007
Modules
Images
c:\users\admin\eizdfmqa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\user32.dll
584"C:\Users\admin\Desktop\funfile.exe" C:\Users\admin\Desktop\funfile.exe—explorer.exe
User:
admin
Company:
Telerik
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.08.0007
Modules
Images
c:\users\admin\desktop\funfile.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1344"C:\Users\admin\Desktop\funfile.exe" C:\Users\admin\Desktop\funfile.exe—funfile.exe
User:
admin
Company:
Telerik
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.08.0007
Modules
Images
c:\users\admin\desktop\funfile.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\user32.dll
1932ping 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2204"C:\Users\admin\bfwacjnx.exe"C:\Users\admin\bfwacjnx.exe—funfile.exe
User:
admin
Company:
Telerik
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.08.0007
Modules
Images
c:\users\admin\bfwacjnx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2380ping 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2736"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2768"C:\Users\admin\Desktop\funfile.exe" C:\Users\admin\Desktop\funfile.exe
funfile.exe
User:
admin
Company:
Telerik
Integrity Level:
MEDIUM
Exit code:
0
Version:
2.08.0007
Modules
Images
c:\users\admin\desktop\funfile.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\user32.dll
2776ping 127.0.0.1 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
3 960
Read events
3 926
Write events
34
Delete events
0

Modification events

(PID) Process:(1344) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1344) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1344) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1344) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2768) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSConfig
Value:
"C:\Users\admin\bfwacjnx.exe"
(PID) Process:(2768) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2768) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2768) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2768) funfile.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3372) bfwacjnx.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSConfig
Value:
"C:\Users\admin\eizdfmqa.exe"
Executable files
1
Suspicious files
5
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1344funfile.exeC:\Users\admin\bfwacjnx.exe —
MD5:—
SHA256:—
2768funfile.exeC:\Users\admin\eizdfmqa.exe —
MD5:—
SHA256:—
2204bfwacjnx.exeC:\Users\admin\AppData\Local\Temp\~DFE1EBC32B3326BE9C.TMPbinary
MD5:F5C11B322240623F75E80FEB18C163BB
SHA256:51CAA98B9878E74DBAF8F9A08E581F102CBECD24114F9F1203C9D697D045F254
2768funfile.exeC:\Users\admin\AppData\Local\Temp\8062.battext
MD5:470C50F8E8720C493819B0CCE1A84C07
SHA256:072352A046D9F7E73C0CD215F82EEA9F2DAFE02C22AFC33627FCD4DF8CB79459
3372bfwacjnx.exeC:\Users\admin\AppData\Local\Temp\4056.battext
MD5:21767FAFF1A014FE08F0A64083DAD25A
SHA256:6CE65E9B1D8D60EBCC8F1F439CA22938E35E193035E4730B4DCEE521B0974A9A
560eizdfmqa.exeC:\Users\admin\AppData\Local\Temp\8304.battext
MD5:D45C789D00EE9BF5DD8F5762C76FC545
SHA256:998E66766F76EDE70A333750107DDCB7A53FB0C4FADC0A41E84B31E0138CB02F
1344funfile.exeC:\Users\admin\AppData\Local\Temp\3116.battext
MD5:470C50F8E8720C493819B0CCE1A84C07
SHA256:072352A046D9F7E73C0CD215F82EEA9F2DAFE02C22AFC33627FCD4DF8CB79459
3372bfwacjnx.exeC:\Users\admin\gkbfhosc.exeexecutable
MD5:D439652C1365F78F071E1FEEFA4B00F3
SHA256:F3BC7485E575B15418591190B66D93B1BFD05F0FDA9580DC714C906F01B7CBDB
268funfile.exeC:\Users\admin\AppData\Local\Temp\~DF00ABD096B2B04AD7.TMPbinary
MD5:F5C11B322240623F75E80FEB18C163BB
SHA256:51CAA98B9878E74DBAF8F9A08E581F102CBECD24114F9F1203C9D697D045F254
584funfile.exeC:\Users\admin\AppData\Local\Temp\~DFF13AF9A708C207B4.TMPbinary
MD5:F5C11B322240623F75E80FEB18C163BB
SHA256:51CAA98B9878E74DBAF8F9A08E581F102CBECD24114F9F1203C9D697D045F254
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
funfile.exe