File name:

BJCA certificate assistant.7z

Full analysis: https://app.any.run/tasks/f1077f56-185d-4c02-a2dd-b142c632f567
Verdict: Malicious activity
Analysis date: June 21, 2021, 12:19:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

994B6A4C18A00A10F5CB78654AF974EE

SHA1:

828F71C361C709D38F69FE73390CB1DD2AAF832D

SHA256:

C8DC89C38B37BB8464C43772A44EF5EC1E3B61B01C4BECE5B4B0D914F2612757

SSDEEP:

393216:ZW0b07U7qtYClVAQk2FHfTtcPSylLMf7rq:ZWrAGjVA+b6PSy+D2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • CertAppEnv_Setup.exe (PID: 2988)
      • CertAppEnv_Setup.exe (PID: 3956)
      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • ns1C3C.tmp (PID: 2748)
      • ns1AE3.tmp (PID: 2220)
      • ns1D18.tmp (PID: 1076)
      • ns1E71.tmp (PID: 2708)
      • ns1FBA.tmp (PID: 2820)
      • ns29AE.tmp (PID: 2384)
      • ns2C4F.tmp (PID: 2988)
      • RegSvr32_x86.exe (PID: 1004)
      • ns2E05.tmp (PID: 2540)
      • RegSvr32_x86.exe (PID: 3316)
      • RegSvr32_x86.exe (PID: 2180)
      • ns2FCB.tmp (PID: 2580)
      • RegSvr32_x86.exe (PID: 3736)
      • XTXCoreSvr.exe (PID: 3232)
      • XTXLogProxy.exe (PID: 3020)
      • ns324D.tmp (PID: 972)
      • XTXCoreSvr.exe (PID: 2224)
      • ns3A1E.tmp (PID: 2896)
      • XTXCoreSvr.exe (PID: 2564)
      • XTXCoreSvr.exe (PID: 3480)
      • SetupHelper.exe (PID: 3288)
      • regrepair.exe (PID: 1544)
      • BJCAScheduleJob.exe (PID: 3248)
      • BJCAUpdateSetup.exe (PID: 1704)
      • BJCAUpdate.exe (PID: 1188)
      • ns620A.tmp (PID: 2364)
      • BJCAUpdate.exe (PID: 3384)
      • BJCAUpdate.exe (PID: 1868)
      • SetupHelper.exe (PID: 1588)
      • BjcaCertAide.exe (PID: 3704)
      • XTXLogProxy.exe (PID: 1012)
      • PubLib_Setup.exe (PID: 3032)

    • Drops executable file immediately after starts

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • BJCAUpdateSetup.exe (PID: 1704)
      • PubLib_Setup.exe (PID: 3032)

    • Loads dropped or rewritten executable

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • RegSvr32_x86.exe (PID: 3316)
      • RegSvr32_x86.exe (PID: 1004)
      • RegSvr32_x86.exe (PID: 2180)
      • XTXCoreSvr.exe (PID: 2224)
      • XTXCoreSvr.exe (PID: 3232)
      • XTXCoreSvr.exe (PID: 2564)
      • RegSvr32_x86.exe (PID: 3736)
      • XTXCoreSvr.exe (PID: 3480)
      • BJCAUpdate.exe (PID: 1188)
      • BJCAUpdate.exe (PID: 3384)
      • BJCAUpdate.exe (PID: 1868)
      • PubLib_Setup.exe (PID: 3032)
      • BjcaCertAide.exe (PID: 3704)

    • Starts NET.EXE for service management

      • ns1AE3.tmp (PID: 2220)
      • ns1D18.tmp (PID: 1076)
      • ns1E71.tmp (PID: 2708)

    • Loads the Task Scheduler COM API

      • BJCAScheduleJob.exe (PID: 3248)
      • BJCAUpdate.exe (PID: 1188)

    • Changes settings of System certificates

      • SetupHelper.exe (PID: 3288)
      • BJCAUpdate.exe (PID: 1188)

    • Changes internet zones settings

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • regrepair.exe (PID: 1544)

    • Loads the Task Scheduler DLL interface

      • BJCAUpdate.exe (PID: 1188)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3404)
      • CertAppEnv_Setup.exe (PID: 3956)
      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • BJCAUpdateSetup.exe (PID: 1704)
      • BJCAUpdate.exe (PID: 1188)
      • PubLib_Setup.exe (PID: 3032)

    • Drops a file with too old compile date

      • CertAppEnv_Setup.exe (PID: 3956)
      • WinRAR.exe (PID: 3404)
      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • PubLib_Setup.exe (PID: 3032)

    • Starts application with an unusual extension

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)

    • Starts SC.EXE for service management

      • ns1FBA.tmp (PID: 2820)

    • Creates a directory in Program Files

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • BJCAUpdate.exe (PID: 1188)
      • PubLib_Setup.exe (PID: 3032)

    • Creates files in the program directory

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • WriteCertAideCfg.exe (PID: 2452)
      • XTXCoreSvr.exe (PID: 2224)
      • BJCAScheduleJob.exe (PID: 3248)
      • BJCAUpdate.exe (PID: 1188)
      • PubLib_Setup.exe (PID: 3032)

    • Drops a file that was compiled in debug mode

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • BJCAUpdateSetup.exe (PID: 1704)
      • BJCAUpdate.exe (PID: 1188)
      • PubLib_Setup.exe (PID: 3032)

    • Drops a file with a compile date too recent

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)

    • Creates/Modifies COM task schedule object

      • RegSvr32_x86.exe (PID: 3316)
      • RegSvr32_x86.exe (PID: 1004)
      • RegSvr32_x86.exe (PID: 2180)
      • RegSvr32_x86.exe (PID: 3736)
      • BJCAUpdate.exe (PID: 1868)
      • BJCAUpdate.exe (PID: 1188)

    • Creates files in the Windows directory

      • XTXCoreSvr.exe (PID: 2564)
      • XTXCoreSvr.exe (PID: 3480)
      • BJCAUpdate.exe (PID: 1188)

    • Executed as Windows Service

      • XTXCoreSvr.exe (PID: 2564)

    • Application launched itself

      • XTXCoreSvr.exe (PID: 2564)

    • Removes files from Windows directory

      • XTXCoreSvr.exe (PID: 2564)

    • Creates a software uninstall entry

      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • PubLib_Setup.exe (PID: 3032)

    • Starts itself from another location

      • BJCAUpdate.exe (PID: 1188)

    • Adds / modifies Windows certificates

      • BJCAUpdate.exe (PID: 1188)

    • Disables SEHOP

      • BJCAUpdate.exe (PID: 1188)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • CertAppEnv_Setup.exe (PID: 3956)
      • CertAppEnv_SetupV3.1.02.0253.exe (PID: 3688)
      • WriteCertAideCfg.exe (PID: 2452)

    • Reads settings of System Certificates

      • SetupHelper.exe (PID: 3288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
97
Monitored processes
44
Malicious processes
9
Suspicious processes
10

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe certappenv_setup.exe no specs certappenv_setup.exe certappenv_setupv3.1.02.0253.exe ns1ae3.tmp no specs net.exe no specs net1.exe no specs ns1c3c.tmp no specs ns1d18.tmp no specs net.exe no specs net1.exe no specs ns1e71.tmp no specs net.exe no specs net1.exe no specs ns1fba.tmp no specs sc.exe no specs writecertaidecfg.exe no specs ns29ae.tmp no specs regsvr32_x86.exe no specs ns2c4f.tmp no specs regsvr32_x86.exe no specs ns2e05.tmp no specs regsvr32_x86.exe no specs ns2fcb.tmp no specs regsvr32_x86.exe no specs xtxlogproxy.exe no specs ns324d.tmp no specs xtxcoresvr.exe no specs ns3a1e.tmp no specs xtxcoresvr.exe no specs xtxcoresvr.exe no specs xtxcoresvr.exe no specs setuphelper.exe no specs regrepair.exe no specs ns620a.tmp no specs bjcaschedulejob.exe no specs bjcaupdatesetup.exe bjcaupdate.exe bjcaupdate.exe no specs bjcaupdate.exe no specs setuphelper.exe no specs bjcacertaide.exe no specs publib_setup.exe xtxlogproxy.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
972"C:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns324D.tmp" "C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\XTXCoreSvr.exe" -k installC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns324D.tmp—CertAppEnv_SetupV3.1.02.0253.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsyf69.tmp\ns324d.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1004"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\RegSvr32_x86.exe" /s "C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\XTXVersion.dll"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\RegSvr32_x86.exe—ns2C4F.tmp
User:
admin
Company:
BeiJing Certificate Authority
Integrity Level:
HIGH
Description:
BJCA® Register Server
Exit code:
0
Version:
4.00
Modules
Images
c:\program files\bjcaclient\certappenvv3.1.02.0253\program\regsvr32_x86.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
1012"C:\Program Files\BJCAClient\Common\XTXLogProxy.exe" /RegServerC:\Program Files\BJCAClient\Common\XTXLogProxy.exe—PubLib_Setup.exe
User:
admin
Company:
北京数字认证股份有限公司
Integrity Level:
HIGH
Description:
XTXAppCOM日志代理程序
Exit code:
0
Version:
2.14.1.0
Modules
Images
c:\program files\bjcaclient\common\xtxlogproxy.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1076"C:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns1D18.tmp" net stop "ASKeyServer"C:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns1D18.tmp—CertAppEnv_SetupV3.1.02.0253.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\nsyf69.tmp\ns1d18.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1188C:\Users\admin\AppData\Local\Temp\GUM66A0.tmp\BJCAUpdate.exe /silent /install "runtime=true&needsadmin=true"C:\Users\admin\AppData\Local\Temp\GUM66A0.tmp\BJCAUpdate.exe
BJCAUpdateSetup.exe
User:
admin
Company:
BJCA.,ltd
Integrity Level:
HIGH
Description:
BJCA Installer
Exit code:
0
Version:
1.3.23.0
Modules
Images
c:\users\admin\appdata\local\temp\gum66a0.tmp\bjcaupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1544"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\regrepair.exe"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\regrepair.exe—CertAppEnv_SetupV3.1.02.0253.exe
User:
admin
Company:
北京数字认证股份有限公司
Integrity Level:
HIGH
Description:
regrepair
Exit code:
0
Version:
0.0.0.1
Modules
Images
c:\program files\bjcaclient\certappenvv3.1.02.0253\program\regrepair.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
1552C:\Windows\system32\net1 stop "XTXCoreSvr"C:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1588"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\SetupHelper.exe" /WirteUpdateReg {BF720538-7840-4325-93CD-CF72FBF3232F}C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\Program\SetupHelper.exe—CertAppEnv_SetupV3.1.02.0253.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\bjcaclient\certappenvv3.1.02.0253\program\setuphelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1704"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\BJCAUpdateSetup.exe" /silent /install "runtime=true&needsadmin=true"C:\Program Files\BJCAClient\CertAppEnvV3.1.02.0253\BJCAUpdateSetup.exe
CertAppEnv_SetupV3.1.02.0253.exe
User:
admin
Company:
BJCA.,Ltd
Integrity Level:
HIGH
Description:
BJCA Update Setup
Exit code:
0
Version:
1.3.23.0
Modules
Images
c:\program files\bjcaclient\certappenvv3.1.02.0253\bjcaupdatesetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1868"C:\Program Files\BJCA\Update\BJCAUpdate.exe" /regserverC:\Program Files\BJCA\Update\BJCAUpdate.exe—BJCAUpdate.exe
User:
admin
Company:
BJCA.,ltd
Integrity Level:
HIGH
Description:
BJCA Installer
Exit code:
0
Version:
1.3.23.0
Modules
Images
c:\program files\bjca\update\bjcaupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
2 382
Read events
1 502
Write events
856
Delete events
24

Modification events

(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3404) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3404) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\BJCA certificate assistant.7z
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3404) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
82
Suspicious files
11
Text files
147
Unknown types
8

Dropped files

PID
Process
Filename
Type
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns1D18.tmp —
MD5:—
SHA256:—
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns1FBA.tmp —
MD5:—
SHA256:—
3956CertAppEnv_Setup.exeC:\Users\admin\AppData\Local\Temp\SubPackage\client_setup.initext
MD5:—
SHA256:—
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ioSpecial.initext
MD5:—
SHA256:—
3956CertAppEnv_Setup.exeC:\Users\admin\AppData\Local\Temp\SubPackage\CertAppEnv_SetupV3.1.02.0253.exeexecutable
MD5:—
SHA256:—
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\System.dllexecutable
MD5:C17103AE9072A06DA581DEC998343FC1
SHA256:DC58D8AD81CACB0C1ED72E33BFF8F23EA40B5252B5BB55D393A0903E6819AE2F
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\modern-wizard.bmpimage
MD5:A8FDE1A124DB158484EFDB71C5B81F98
SHA256:1258FD4DEB28CFE24C73FA3C83ED8060C65AC28355B932CB4CB9B478B7492FAE
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\nsExec.dllexecutable
MD5:ACC2B699EDFEA5BF5AAE45ABA3A41E96
SHA256:168A974EAA3F588D759DB3F47C1A9FDC3494BA1FA1A73A84E5E3B2A4D58ABD7E
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\InstallOptions.dllexecutable
MD5:325B008AEC81E5AAA57096F05D4212B5
SHA256:C9CD5C9609E70005926AE5171726A4142FFBCCCC771D307EFCD195DAFC1E6B4B
3688CertAppEnv_SetupV3.1.02.0253.exeC:\Users\admin\AppData\Local\Temp\nsyF69.tmp\ns1AE3.tmpexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
time.bjca.org.cn
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BJCA certificate assistant.7z