File name:

Bonzify.exe

Full analysis: https://app.any.run/tasks/a3592cb3-8aee-4f98-b61a-163ed83aba53
Verdict: Malicious activity
Analysis date: March 16, 2024, 15:51:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9C352D2CE0C0BDC40C72F52CE3480577

SHA1:

BD4C956186F33C92EB4469F7E5675510D0790E99

SHA256:

D7E6580054525D3F21F86EDFC9F30B7A75FFA829A1EB67EE3CAB33F0040DBA4E

SSDEEP:

196608:/dAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3o:naWedh+Idx75QYub//73lc6u7bLMYxDo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Bonzify.exe (PID: 3940)
      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)

    • Registers / Runs the DLL via REGSVR32.EXE

      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)

    • Changes the autorun value in the registry

      • INSTALLER.exe (PID: 3324)
      • tlntsess.exe (PID: 324)
      • dllhost.exe (PID: 6008)
      • dllhost.exe (PID: 5204)

    • Creates a writable file in the system directory

      • INSTALLER.exe (PID: 3324)

    • Changes the AppInit_DLLs value (autorun option)

      • Bonzify.exe (PID: 3940)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 3956)

    • Antivirus name has been found in the command line (generic signature)

      • reset.exe (PID: 5072)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Bonzify.exe (PID: 3940)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 4044)

    • Executing commands from a ".bat" file

      • Bonzify.exe (PID: 3940)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 4044)

    • Starts a Microsoft application from unusual location

      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4044)

    • Executable content was dropped or overwritten

      • Bonzify.exe (PID: 3940)
      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)

    • Process drops legitimate windows executable

      • Bonzify.exe (PID: 3940)
      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 748)
      • regsvr32.exe (PID: 1560)
      • regsvr32.exe (PID: 1992)
      • regsvr32.exe (PID: 1860)
      • regsvr32.exe (PID: 240)
      • regsvr32.exe (PID: 1572)
      • regsvr32.exe (PID: 3400)
      • regsvr32.exe (PID: 2744)
      • regsvr32.exe (PID: 1308)
      • msedge.exe (PID: 3124)
      • chrome.exe (PID: 548)
      • WINWORD.EXE (PID: 3956)
      • chrome.exe (PID: 3564)
      • chrome.exe (PID: 1812)
      • rasphone.exe (PID: 3988)

    • Creates a software uninstall entry

      • INSTALLER.exe (PID: 3324)

    • Creates file in the systems drive root

      • Bonzify.exe (PID: 3940)
      • chrome.exe (PID: 3564)
      • chrome.exe (PID: 548)
      • msedge.exe (PID: 2556)
      • msedge.exe (PID: 1428)
      • chrome.exe (PID: 3084)
      • chrome.exe (PID: 2032)
      • msedge.exe (PID: 3768)
      • chrome.exe (PID: 1812)
      • msedge.exe (PID: 3748)
      • chrome.exe (PID: 2536)
      • chrome.exe (PID: 3684)
      • chrome.exe (PID: 3660)
      • chrome.exe (PID: 1692)
      • WINWORD.EXE (PID: 3956)
      • chrome.exe (PID: 2292)
      • chrome.exe (PID: 3976)
      • chrome.exe (PID: 2168)
      • msedge.exe (PID: 1864)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 984)
      • chrome.exe (PID: 1484)
      • chrome.exe (PID: 1748)
      • chrome.exe (PID: 3140)
      • msedge.exe (PID: 3132)
      • msedge.exe (PID: 532)
      • msedge.exe (PID: 3108)
      • chrome.exe (PID: 4040)
      • chrome.exe (PID: 3080)
      • msedge.exe (PID: 1344)
      • chrome.exe (PID: 1884)
      • msedge.exe (PID: 3124)
      • msedge.exe (PID: 2988)
      • chrome.exe (PID: 3256)
      • Eap3Host.exe (PID: 3572)
      • ntvdm.exe (PID: 2744)
      • chrome.exe (PID: 4144)
      • relog.exe (PID: 120)
      • unlodctr.exe (PID: 3416)
      • chrome.exe (PID: 4296)
      • TsUsbRedirectionGroupPolicyControl.exe (PID: 4452)
      • BrmfRsmg.exe (PID: 4616)
      • chrome.exe (PID: 4816)
      • NETFXSBS10.exe (PID: 5260)
      • find.exe (PID: 5252)
      • chrome.exe (PID: 4428)
      • alg.exe (PID: 4676)
      • qwinsta.exe (PID: 4520)
      • McrMgr.exe (PID: 5684)
      • tskill.exe (PID: 3544)
      • ie4uinit.exe (PID: 5928)
      • IEExec.exe (PID: 1772)
      • dllhost.exe (PID: 6008)
      • aitstatic.exe (PID: 4500)
      • gpupdate.exe (PID: 4916)
      • tlntsess.exe (PID: 324)
      • bcdboot.exe (PID: 2576)
      • rasphone.exe (PID: 3988)
      • shrpubw.exe (PID: 4852)
      • wermgr.exe (PID: 3360)
      • jsc.exe (PID: 3332)
      • ie4uinit.exe (PID: 1268)
      • taskhost.exe (PID: 5540)
      • dllhost.exe (PID: 5204)
      • Utilman.exe (PID: 4940)
      • Mahjong.exe (PID: 2964)
      • ctfmon.exe (PID: 4388)
      • ngen.exe (PID: 2564)
      • infocard.exe (PID: 2928)
      • EOSNotify.exe (PID: 5216)
      • wbemtest.exe (PID: 3736)
      • sipnotify.exe (PID: 1992)
      • p2phost.exe (PID: 2184)
      • dllhost.exe (PID: 2572)
      • PresentationFontCache.exe (PID: 3128)
      • ehrec.exe (PID: 3496)

    • Non-standard symbols in registry

      • WINWORD.EXE (PID: 3956)

    • Adds/modifies Windows certificates

      • WINWORD.EXE (PID: 3956)

    • Changes internet zones settings

      • WINWORD.EXE (PID: 3956)
      • dllhost.exe (PID: 6008)
      • dllhost.exe (PID: 5204)
      • rasphone.exe (PID: 3988)
      • dllhost.exe (PID: 2572)
      • infocard.exe (PID: 2928)

    • Uses ATTRIB.EXE to modify file attributes

      • chrome.exe (PID: 548)

    • Executed via WMI

      • bcdboot.exe (PID: 2576)
      • auditpol.exe (PID: 4772)
      • shrpubw.exe (PID: 4852)
      • auditpol.exe (PID: 5904)
      • reset.exe (PID: 5072)
      • infocard.exe (PID: 2928)
      • winresume.exe (PID: 612)
      • wermgr.exe (PID: 4464)

    • Executes as Windows Service

      • taskhost.exe (PID: 5540)
      • dllhost.exe (PID: 5204)
      • dllhost.exe (PID: 2572)
      • EOSNotify.exe (PID: 5216)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 4388)
      • sipnotify.exe (PID: 1992)
      • ehrec.exe (PID: 3496)
      • shrpubw.exe (PID: 3284)
      • VSSVC.exe (PID: 424)

    • Checks Windows Trust Settings

      • infocard.exe (PID: 2928)
      • PresentationFontCache.exe (PID: 3128)

    • Reads security settings of Internet Explorer

      • infocard.exe (PID: 2928)

    • Reads settings of System Certificates

      • infocard.exe (PID: 2928)

    • Reads the Internet Settings

      • infocard.exe (PID: 2928)

  • INFO

    • Checks supported languages

      • Bonzify.exe (PID: 3940)
      • INSTALLER.exe (PID: 2372)
      • AgentSvr.exe (PID: 1112)
      • INSTALLER.exe (PID: 3324)
      • AgentSvr.exe (PID: 2320)
      • wmpnscfg.exe (PID: 3496)
      • wmpnscfg.exe (PID: 2188)
      • Eap3Host.exe (PID: 3572)
      • relog.exe (PID: 120)
      • mpnotify.exe (PID: 4996)
      • TsUsbRedirectionGroupPolicyControl.exe (PID: 4452)
      • BrmfRsmg.exe (PID: 4616)
      • NETFXSBS10.exe (PID: 5260)
      • mscorsvw.exe (PID: 5016)
      • IEExec.exe (PID: 1772)
      • aitstatic.exe (PID: 4500)
      • McrMgr.exe (PID: 5684)
      • tlntsess.exe (PID: 324)
      • auditpol.exe (PID: 4772)
      • shrpubw.exe (PID: 4852)
      • wermgr.exe (PID: 3360)
      • jsc.exe (PID: 3332)
      • ie4uinit.exe (PID: 1268)
      • ngen.exe (PID: 2564)
      • infocard.exe (PID: 2928)
      • Mahjong.exe (PID: 2964)
      • wbemtest.exe (PID: 3736)
      • ehrec.exe (PID: 3496)
      • PresentationFontCache.exe (PID: 3128)

    • Create files in a temporary directory

      • Bonzify.exe (PID: 3940)
      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)
      • NETFXSBS10.exe (PID: 5260)
      • ntvdm.exe (PID: 2744)

    • Reads the computer name

      • INSTALLER.exe (PID: 2372)
      • INSTALLER.exe (PID: 3324)
      • AgentSvr.exe (PID: 2320)
      • Bonzify.exe (PID: 3940)
      • wmpnscfg.exe (PID: 3496)
      • wmpnscfg.exe (PID: 2188)
      • Eap3Host.exe (PID: 3572)
      • relog.exe (PID: 120)
      • mpnotify.exe (PID: 4996)
      • TsUsbRedirectionGroupPolicyControl.exe (PID: 4452)
      • BrmfRsmg.exe (PID: 4616)
      • McrMgr.exe (PID: 5684)
      • shrpubw.exe (PID: 4852)
      • auditpol.exe (PID: 4772)
      • tlntsess.exe (PID: 324)
      • infocard.exe (PID: 2928)
      • wbemtest.exe (PID: 3736)
      • ehrec.exe (PID: 3496)
      • PresentationFontCache.exe (PID: 3128)

    • Manual execution by a user

      • chrome.exe (PID: 3084)
      • chrome.exe (PID: 3564)
      • msedge.exe (PID: 1428)
      • msedge.exe (PID: 2556)
      • WINWORD.EXE (PID: 3956)
      • explorer.exe (PID: 1652)
      • wmpnscfg.exe (PID: 3496)
      • wmpnscfg.exe (PID: 2188)
      • appcmd.exe (PID: 1092)
      • winload.exe (PID: 2016)
      • aitstatic.exe (PID: 4500)
      • NETFXSBS10.exe (PID: 5260)
      • EdmGen.exe (PID: 2384)
      • mscorsvw.exe (PID: 5016)
      • McrMgr.exe (PID: 5684)

    • Reads the machine GUID from the registry

      • AgentSvr.exe (PID: 2320)
      • Bonzify.exe (PID: 3940)
      • McrMgr.exe (PID: 5684)
      • tlntsess.exe (PID: 324)
      • shrpubw.exe (PID: 4852)
      • jsc.exe (PID: 3332)
      • Mahjong.exe (PID: 2964)
      • infocard.exe (PID: 2928)
      • wbemtest.exe (PID: 3736)
      • ehrec.exe (PID: 3496)
      • PresentationFontCache.exe (PID: 3128)

    • Application launched itself

      • chrome.exe (PID: 3564)
      • msedge.exe (PID: 2556)
      • chrome.exe (PID: 3084)
      • msedge.exe (PID: 1428)
      • msedge.exe (PID: 3748)

    • Checks transactions between databases Windows and Oracle

      • dllhost.exe (PID: 5204)
      • dllhost.exe (PID: 2572)

    • Changes appearance of the Explorer extensions

      • dllhost.exe (PID: 5204)

    • Reads the software policy settings

      • infocard.exe (PID: 2928)
      • PresentationFontCache.exe (PID: 3128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (86.7)
.exe | Win32 Executable MS Visual C++ (generic) (8.9)
.dll | Win32 Dynamic Link Library (generic) (1.8)
.exe | Win32 Executable (generic) (1.2)
.exe | Generic Win/DOS Executable (0.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:04 14:58:11+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 4096
InitializedDataSize: 6697472
UninitializedDataSize: -
EntryPoint: 0x16b0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
394
Monitored processes
131
Malicious processes
16
Suspicious processes
10

Behavior graph

Click at the process to see the details
start bonzify.exe cmd.exe no specs taskkill.exe no specs takeown.exe no specs icacls.exe no specs installer.exe regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs agentsvr.exe no specs grpconv.exe no specs installer.exe regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs agentsvr.exe chrome.exe chrome.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs winword.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs explorer.exe no specs msedge.exe no specs wmpnscfg.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs appcmd.exe no specs mrinfo.exe no specs ilasm.exe no specs winload.exe no specs ntvdm.exe no specs eap3host.exe no specs chgusr.exe no specs unlodctr.exe no specs relog.exe no specs tcpsvcs.exe no specs chrome.exe no specs fxsunatd.exe no specs eudcsettings.exe no specs tskill.exe no specs chrome.exe no specs attrib.exe no specs searchprotocolhost.exe no specs chrome.exe no specs regini.exe no specs chrome.exe no specs tsusbredirectiongrouppolicycontrol.exe no specs aitstatic.exe no specs qwinsta.exe no specs systempropertiesdataexecutionprevention.exe no specs brmfrsmg.exe no specs alg.exe no specs chrome.exe no specs gpupdate.exe no specs mpnotify.exe no specs msaccess.exe no specs hdwwiz.exe no specs find.exe no specs netfxsbs10.exe no specs mcrmgr.exe no specs auditpol.exe no specs ie4uinit.exe no specs ieexec.exe no specs edmgen.exe no specs mscorsvw.exe no specs Profile Notification Host tlntsess.exe bcdboot.exe no specs ntkrnlpa.exe no specs rasphone.exe no specs auditpol.exe no specs shrpubw.exe no specs dllhost.exe utilman.exe no specs jsc.exe no specs wermgr.exe no specs reset.exe no specs ie4uinit.exe no specs ntoskrnl.exe no specs taskhost.exe no specs auditpol.exe no specs mahjong.exe no specs ngen.exe no specs ctfmon.exe no specs sipnotify.exe no specs infocard.exe shrpubw.exe no specs dllhost.exe no specs wbemtest.exe eosnotify.exe no specs p2phost.exe no specs presentationfontcache.exe no specs ehrec.exe no specs winresume.exe no specs winload.exe no specs aspnet_wp.exe no specs print.exe no specs wermgr.exe no specs vssvc.exe no specs bonzify.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\relog.exe"C:\Windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\relog.exe—chrome.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Performance Relogging Utility
Exit code:
11
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\winsxs\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_632ae4bc5d173763\relog.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
240regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"C:\Windows\System32\regsvr32.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
324"C:\Windows\winsxs\x86_microsoft-windows-telnet-server-tlntsess_31bf3856ad364e35_6.1.7600.16385_none_a9cd5618e9d2d300\tlntsess.exe"C:\Windows\winsxs\x86_microsoft-windows-telnet-server-tlntsess_31bf3856ad364e35_6.1.7600.16385_none_a9cd5618e9d2d300\tlntsess.exe
dllhost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Telnet Server Helper
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\winsxs\x86_microsoft-windows-telnet-server-tlntsess_31bf3856ad364e35_6.1.7600.16385_none_a9cd5618e9d2d300\tlntsess.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
412"C:\Windows\SysWow64\print.exe"C:\Windows\System32\print.exe—dllhost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Print Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
424"C:\Windows\winsxs\x86_microsoft-windows-vssservice_31bf3856ad364e35_6.1.7601.17514_none_5cd4386276198cd2\VSSVC.exe"C:\Windows\winsxs\x86_microsoft-windows-vssservice_31bf3856ad364e35_6.1.7601.17514_none_5cd4386276198cd2\VSSVC.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
532"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1164 --field-trial-handle=1380,i,13490081635525181479,15986496972037266640,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xd4,0xd8,0xdc,0xac,0xe0,0x71988b38,0x71988b48,0x71988b54C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
612"C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.23539_none_5da6f30ce41285cd\winresume.exe"C:\Windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.23539_none_5da6f30ce41285cd\winresume.exe—WmiPrvSE.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Resume From Hibernate boot application
Exit code:
0
Version:
6.1.7601.23003 (win7sp1_ldr.150317-1510)
Modules
Images
c:\windows\winsxs\x86_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.23539_none_5da6f30ce41285cd\winresume.exe
c:\windows\system32\ntdll.dll
748regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"C:\Windows\System32\regsvr32.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
984"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=1648 --field-trial-handle=1236,i,10367648673522318350,3066183693346873426,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
1
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
30 015
Read events
27 849
Write events
1 835
Delete events
331

Modification events

(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Control
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus\1
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Programmable
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ToolboxBitmap32
Operation:delete keyName:(default)
Value:
(PID) Process:(748) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\TypeLib
Operation:delete keyName:(default)
Value:
Executable files
53
Suspicious files
48
Text files
96
Unknown types
29

Dropped files

PID
Process
Filename
Type
2372INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLLexecutable
MD5:A334BBF5F5A19B3BDB5B7F1703363981
SHA256:C33BEABA130F8B740DDDB9980FE9012F9322AC6E94F36A6AA6086851C51B98DE
3940Bonzify.exeC:\Users\admin\AppData\Local\Temp\INSTALLER.exeexecutable
MD5:66996A076065EBDCDAC85FF9637CEAE0
SHA256:16CA09AD70561F413376AD72550AE5664C89C6A76C85C872FFE2CB1E7F49E2AA
3940Bonzify.exeC:\Users\admin\AppData\Local\Temp\TakeOwn.battext
MD5:F80E36CD406022944558D8A099DB0FA7
SHA256:7B41E5A6C2DD92F60C38CB4FE09DCBE378C3E99443F7BAF079ECE3608497BDC7
2372INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLexecutable
MD5:316999655FEF30C52C3854751C663996
SHA256:EA4CA740CD60D2C88280FF8115BF354876478EF27E9E676D8B66601B4E900BA0
2372INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLLexecutable
MD5:48C00A7493B28139CBF197CCC8D1F9ED
SHA256:905CB1A15ECCAA9B79926EE7CFE3629A6F1C6B24BDD6CEA9CCB9EBC9EAA92FF7
3940Bonzify.exeC:\Users\admin\AppData\Local\Temp\KillAgent.battext
MD5:EA7DF060B402326B4305241F21F39736
SHA256:E4EDC2CB6317AB19EE1A6327993E9332AF35CFBEBAFF2AC7C3F71D43CFCBE793
2372INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLLexecutable
MD5:237E13B95AB37D0141CF0BC585B8DB94
SHA256:D19B6B7C57BCEE7239526339E683F62D9C2F9690947D0A446001377F0B56103A
3940Bonzify.exeC:\Windows\executables.binbinary
MD5:F3160BA7F8BB9D7A9C6080EF2C9869C5
SHA256:F6A3286714A661612EAC65E4A6CB78736C370492151B692A8F1E666740C0A00E
2372INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INFbinary
MD5:B127D9187C6DBB1B948053C7C9A6811F
SHA256:BD1295D19D010D4866C9D6D87877913EEE69E279D4D089E5756BA285F3424E00
2372INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLexecutable
MD5:81E5C8596A7E4E98117F5C5143293020
SHA256:7D126ED85DF9705EC4F38BD52A73B621CF64DD87A3E8F9429A569F3F82F74004
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
403
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/j2hxfei2occ5siitujtlwgp6xi_3/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
unknown
—
—
unknown
2864
RMActivate_isv.exe
GET
200
84.53.175.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e6cb58393ec7bf72
unknown
compressed
4.66 Kb
unknown
5100
infocard.exe
GET
200
84.53.175.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d7fd858ca2488e2
unknown
compressed
4.66 Kb
unknown
5100
infocard.exe
GET
200
95.101.21.9:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
binary
767 b
unknown
5100
infocard.exe
GET
200
95.101.21.9:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
binary
564 b
unknown
2928
infocard.exe
GET
200
84.53.175.122:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d0792f0471a92409
unknown
compressed
4.66 Kb
unknown
2928
infocard.exe
GET
200
95.101.21.9:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
binary
767 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1812
chrome.exe
142.250.102.84:443
accounts.google.com
GOOGLE
US
unknown
1812
chrome.exe
142.250.179.195:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
3564
chrome.exe
239.255.255.250:1900
—
—
—
unknown
1812
chrome.exe
142.251.36.36:443
www.google.com
GOOGLE
US
whitelisted
1812
chrome.exe
172.217.23.195:443
update.googleapis.com
GOOGLE
US
whitelisted
1812
chrome.exe
142.251.36.10:443
www.googleapis.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.251.36.36
whitelisted
accounts.google.com
  • 142.250.102.84
shared
clientservices.googleapis.com
  • 142.250.179.195
whitelisted
update.googleapis.com
  • 172.217.23.195
whitelisted
www.googleapis.com
  • 142.251.36.10
whitelisted
nw-umwatson.events.data.microsoft.com
  • 20.189.173.22
whitelisted
clients1.google.com
  • 172.217.23.206
whitelisted
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
ctldl.windowsupdate.com
  • 84.53.175.122
whitelisted
www.bing.com
  • 2.22.54.122
whitelisted

Threats

No threats detected
Process
Message
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bonzify.exe