URL:

http://files.bbsoftware.co.uk/bbfbex5.exe

Full analysis: https://app.any.run/tasks/b8507e9a-b3e2-46a3-b226-ad5a60c8732a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 11, 2019, 05:51:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

1B3E8884914D5CEEB91553508B292984

SHA1:

5D339A0FE9F3ED90C51C471BA2367713320D8645

SHA256:

86C8D504DFC76D73EFCD6CBEDF61354863B3944FAB04779C055FD3F4F360E641

SSDEEP:

3:N1KYyniBLIjHyA:CYynyI7yA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • opera.exe (PID: 2408)

    • Application was dropped or rewritten from another process

      • bbfbex5.exe (PID: 3848)
      • bbfbex5.exe (PID: 2132)
      • ns6EB0.tmp (PID: 1608)
      • LogSysServer.exe (PID: 2076)
      • LogSysServer.exe (PID: 1412)
      • FlashBack Recorder.exe (PID: 1820)
      • DefConfig.exe (PID: 2692)
      • DefConfig.exe (PID: 2988)
      • DefConfig.exe (PID: 2400)
      • ns70E4.tmp (PID: 1576)
      • ns7394.tmp (PID: 2548)

    • Loads dropped or rewritten executable

      • bbfbex5.exe (PID: 2132)
      • DefConfig.exe (PID: 2692)
      • DefConfig.exe (PID: 2988)
      • FlashBack Recorder.exe (PID: 1820)
      • LogSysServer.exe (PID: 2076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • opera.exe (PID: 2408)
      • bbfbex5.exe (PID: 2132)

    • Executed via COM

      • explorer.exe (PID: 2160)

    • Creates files in the user directory

      • bbfbex5.exe (PID: 2132)
      • DefConfig.exe (PID: 2988)
      • DefConfig.exe (PID: 2692)
      • DefConfig.exe (PID: 2400)
      • LogSysServer.exe (PID: 2076)
      • FlashBack Recorder.exe (PID: 1820)

    • Modifies the open verb of a shell class

      • bbfbex5.exe (PID: 2132)

    • Creates COM task schedule object

      • bbfbex5.exe (PID: 2132)

    • Starts application with an unusual extension

      • bbfbex5.exe (PID: 2132)

    • Creates a software uninstall entry

      • bbfbex5.exe (PID: 2132)

    • Creates files in the program directory

      • bbfbex5.exe (PID: 2132)
      • FlashBack Recorder.exe (PID: 1820)

    • Reads CPU info

      • LogSysServer.exe (PID: 2076)

    • Reads internet explorer settings

      • FlashBack Recorder.exe (PID: 1820)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • bbfbex5.exe (PID: 2132)

    • Creates files in the user directory

      • opera.exe (PID: 2408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
14
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start opera.exe explorer.exe no specs explorer.exe no specs bbfbex5.exe no specs bbfbex5.exe ns6eb0.tmp no specs defconfig.exe no specs ns70e4.tmp no specs defconfig.exe no specs ns7394.tmp no specs defconfig.exe no specs flashback recorder.exe logsysserver.exe logsysserver.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1412"C:\Program Files\Blueberry Software\FlashBack Express 5\LogSysServer.exe" -xC:\Program Files\Blueberry Software\FlashBack Express 5\LogSysServer.exe—FlashBack Recorder.exe
User:
admin
Company:
Blueberry Consultants
Integrity Level:
HIGH
Description:
LogSysServer Application
Exit code:
0
Version:
1.6.1.137
Modules
Images
c:\program files\blueberry software\flashback express 5\logsysserver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1576"C:\Users\admin\AppData\Local\Temp\nsr2429.tmp\ns70E4.tmp" C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\DefConfig.exe -add "FTP" "C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\FtpPublisher.dll" "FBExpress5"C:\Users\admin\AppData\Local\Temp\nsr2429.tmp\ns70E4.tmp—bbfbex5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsr2429.tmp\ns70e4.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1608"C:\Users\admin\AppData\Local\Temp\nsr2429.tmp\ns6EB0.tmp" C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\DefConfig.exe -add "File Copy" "C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\FileCopyPublisher.dll" "FBExpress5"C:\Users\admin\AppData\Local\Temp\nsr2429.tmp\ns6EB0.tmp—bbfbex5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsr2429.tmp\ns6eb0.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1820"C:\Program Files\Blueberry Software\FlashBack Express 5\FlashBack Recorder.exe" C:\Program Files\Blueberry Software\FlashBack Express 5\FlashBack Recorder.exe
bbfbex5.exe
User:
admin
Company:
Blueberry Consultants Ltd.
Integrity Level:
HIGH
Description:
FlashBack Express 5 Recorder
Exit code:
0
Version:
5.38.0.4495
Modules
Images
c:\program files\blueberry software\flashback express 5\flashback recorder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\blueberry software\flashback express 5\rtl260.bpl
c:\windows\system32\mpr.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2076"C:\Program Files\Blueberry Software\FlashBack Express 5\LogSysServer.exe" -xC:\Program Files\Blueberry Software\FlashBack Express 5\LogSysServer.exe
FlashBack Recorder.exe
User:
admin
Company:
Blueberry Consultants
Integrity Level:
HIGH
Description:
LogSysServer Application
Exit code:
0
Version:
1.6.1.137
Modules
Images
c:\program files\blueberry software\flashback express 5\logsysserver.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2132"C:\Users\admin\Documents\bbfbex5.exe" C:\Users\admin\Documents\bbfbex5.exe
explorer.exe
User:
admin
Company:
Blueberry Software (UK) Ltd.
Integrity Level:
HIGH
Exit code:
0
Version:
5.38.0.4495
Modules
Images
c:\users\admin\documents\bbfbex5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2160C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2400"C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\DefConfig.exe" -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\YouTubePublisher.dll" "FBExpress5"C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\DefConfig.exe—ns7394.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\blueberry software\flashback express 5\uploadprofiles\defconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2408"C:\Program Files\Opera\opera.exe" "http://files.bbsoftware.co.uk/bbfbex5.exe"C:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
2548"C:\Users\admin\AppData\Local\Temp\nsr2429.tmp\ns7394.tmp" C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\DefConfig.exe -add "YouTube" "C:\Program Files\Blueberry Software\FlashBack Express 5\UploadProfiles\YouTubePublisher.dll" "FBExpress5"C:\Users\admin\AppData\Local\Temp\nsr2429.tmp\ns7394.tmp—bbfbex5.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsr2429.tmp\ns7394.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
2 279
Read events
1 852
Write events
425
Delete events
2

Modification events

(PID) Process:(2408) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "http://files.bbsoftware.co.uk/bbfbex5.exe"
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
02000000070000000100000009000000080000000000000006000000030000000500000004000000FFFFFFFF
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2408) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:FFlags
Value:
1092616257
Executable files
84
Suspicious files
32
Text files
146
Unknown types
34

Dropped files

PID
Process
Filename
Type
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprAF36.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprAF46.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprAF86.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9LZ3J49XQOM5CSG8S0NU.temp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00003.tmp —
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\g_0000\opr00001.tmpexecutable
MD5:—
SHA256:—
2408opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\CACHEDIR.TAGtext
MD5:E717F92FA29AE97DBE4F6F5C04B7A3D9
SHA256:5BBD5DCBF87FD8CD7544C522BADF22A2951CF010AD9F25C40F9726F09EA2B552
2408opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
8
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2408
opera.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
528 b
whitelisted
2408
opera.exe
GET
200
52.222.149.2:80
http://files.bbsoftware.co.uk/bbfbex5.exe
US
executable
23.9 Mb
whitelisted
1820
FlashBack Recorder.exe
POST
200
104.27.150.13:80
http://regsys.ws.bbsoftware.co.uk/regsys.svc
US
text
1.64 Kb
malicious
2408
opera.exe
GET
400
107.167.110.211:80
http://sitecheck2.opera.com/?host=files.bbsoftware.co.uk&hdn=ZphP4PGdrSvC4DWygB4ouw==
US
html
150 b
whitelisted
1820
FlashBack Recorder.exe
POST
200
54.171.208.68:80
http://stats.ws.bbsoftware.co.uk/stats.asmx
IE
xml
399 b
suspicious
1820
FlashBack Recorder.exe
POST
200
104.27.150.13:80
http://regsys.ws.bbsoftware.co.uk/regsys.svc
US
text
1.29 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2408
opera.exe
52.222.149.187:80
files.bbsoftware.co.uk
Amazon.com, Inc.
US
whitelisted
—
—
107.167.110.211:80
sitecheck2.opera.com
Opera Software Americas LLC
US
suspicious
2408
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
2408
opera.exe
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2408
opera.exe
52.222.149.2:80
files.bbsoftware.co.uk
Amazon.com, Inc.
US
malicious
1820
FlashBack Recorder.exe
104.27.176.75:443
www.flashbackrecorder.com
Cloudflare Inc
US
unknown
2076
LogSysServer.exe
130.159.196.118:123
ntp.cis.strath.ac.uk
Jisc Services Limited
GB
unknown
—
—
104.27.176.75:443
www.flashbackrecorder.com
Cloudflare Inc
US
unknown
1820
FlashBack Recorder.exe
104.27.150.13:80
regsys.ws.bbsoftware.co.uk
Cloudflare Inc
US
shared
1820
FlashBack Recorder.exe
54.171.208.68:80
stats.ws.bbsoftware.co.uk
Amazon.com, Inc.
IE
suspicious

DNS requests

Domain
IP
Reputation
files.bbsoftware.co.uk
  • 52.222.149.187
  • 52.222.149.2
  • 52.222.149.19
  • 52.222.149.206
whitelisted
sitecheck2.opera.com
  • 107.167.110.211
  • 107.167.110.216
whitelisted
certs.opera.com
  • 185.26.182.94
  • 185.26.182.93
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted
ntp.cis.strath.ac.uk
  • 130.159.196.118
  • 130.159.196.117
unknown
regsys.ws.bbsoftware.co.uk
  • 104.27.150.13
  • 104.27.151.13
malicious
stats.ws.bbsoftware.co.uk
  • 54.171.208.68
suspicious
www.flashbackrecorder.com
  • 104.27.176.75
  • 104.27.177.75
malicious

Threats

PID
Process
Class
Message
2408
opera.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
2408
opera.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://files.bbsoftware.co.uk/bbfbex5.exe