File name:

Bonzify.exe

Full analysis: https://app.any.run/tasks/f6e83450-2f08-48b0-961c-b007c049afb4
Verdict: Malicious activity
Analysis date: January 06, 2024, 00:28:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7E5FBEA7EE5A03D2C6DEE20854DEED2E

SHA1:

E3D6D23BACC182E8036FB5E38D9E8FD26830045C

SHA256:

E369B688C86695960657DCF3CF63626C8C47095832C4A85E2D317E31AB8EF497

SSDEEP:

98304:5YFIsQd4i6QcdsbjxHqi/iXrPFt4BZkHj+Ml8TV9EFvxiKJT+7L51fo6bxHKrDWt:5yQ8nQqClXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Creates a writable file in the system directory

      • INSTALLER.exe (PID: 376)

    • Changes the AppInit_DLLs value (autorun option)

      • Bonzify.exe (PID: 1576)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 3248)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Bonzify.exe (PID: 1576)

    • Executing commands from a ".bat" file

      • Bonzify.exe (PID: 1576)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1792)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 1792)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1792)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 796)
      • WINWORD.EXE (PID: 3248)
      • iexpress.exe (PID: 4996)

    • Changes internet zones settings

      • WINWORD.EXE (PID: 3248)
      • iexpress.exe (PID: 4996)

    • Process changes security settings for the VBA macro

      • iexpress.exe (PID: 4996)

  • INFO

    • Drops the executable file immediately after the start

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Checks supported languages

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • AgentSvr.exe (PID: 2592)
      • INSTALLER.exe (PID: 376)
      • AgentSvr.exe (PID: 2052)
      • wmpnscfg.exe (PID: 3120)
      • DW20.EXE (PID: 1220)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • wmpnscfg.exe (PID: 2988)
      • Utilman.exe (PID: 2632)
      • iexpress.exe (PID: 4996)
      • ComSvcConfig.exe (PID: 1652)
      • services.exe (PID: 5868)
      • IMJPDSVR.EXE (PID: 2292)

    • Process drops legitimate windows executable

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Reads the computer name

      • INSTALLER.exe (PID: 1844)
      • AgentSvr.exe (PID: 2052)
      • Bonzify.exe (PID: 1576)
      • wmpnscfg.exe (PID: 3120)
      • INSTALLER.exe (PID: 376)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • wmpnscfg.exe (PID: 2988)
      • services.exe (PID: 5868)

    • Create files in a temporary directory

      • INSTALLER.exe (PID: 1844)
      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 376)

    • Reads the machine GUID from the registry

      • Bonzify.exe (PID: 1576)
      • AgentSvr.exe (PID: 2052)
      • wbemtest.exe (PID: 3228)
      • Utilman.exe (PID: 2632)
      • iexpress.exe (PID: 4996)
      • services.exe (PID: 5868)
      • IMJPMGR.EXE (PID: 3600)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3120)
      • wbemtest.exe (PID: 3228)
      • ktmutil.exe (PID: 2312)
      • pcwrun.exe (PID: 3904)
      • IMJPMGR.EXE (PID: 3600)
      • wmpnscfg.exe (PID: 2988)
      • WINWORD.EXE (PID: 3248)
      • vmicsvc.exe (PID: 2740)
      • ComSvcConfig.exe (PID: 1652)
      • Utilman.exe (PID: 2632)
      • control.exe (PID: 2952)
      • netcfg.exe (PID: 2724)
      • LocationNotifications.exe (PID: 3084)
      • iexpress.exe (PID: 4996)
      • WerFaultSecure.exe (PID: 2736)
      • services.exe (PID: 5868)
      • RMActivate_ssp.exe (PID: 4516)
      • relog.exe (PID: 5160)
      • iscsicpl.exe (PID: 5988)
      • DVDMaker.exe (PID: 5796)
      • ntkrnlpa.exe (PID: 2260)
      • logman.exe (PID: 4184)
      • wmpnscfg.exe (PID: 5320)

    • Process checks are UAC notifies on

      • IMJPMGR.EXE (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (80.4)
.exe | Win32 Executable MS Visual C++ (generic) (8.2)
.exe | Win64 Executable (generic) (7.3)
.dll | Win32 Dynamic Link Library (generic) (1.7)
.exe | Win32 Executable (generic) (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:11:07 19:29:20+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 4096
InitializedDataSize: 3719680
UninitializedDataSize: -
EntryPoint: 0x16b0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
436
Monitored processes
55
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bonzify.exe cmd.exe no specs taskkill.exe no specs takeown.exe no specs icacls.exe no specs installer.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs agentsvr.exe no specs grpconv.exe no specs installer.exe no specs regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs agentsvr.exe wmpnscfg.exe no specs wmpnscfg.exe no specs winword.exe no specs vmicsvc.exe no specs sbunattend.exe no specs dw20.exe no specs dwwin.exe wbemtest.exe no specs perfmon.exe no specs pcwrun.exe no specs ktmutil.exe no specs imjpmgr.exe no specs comsvcconfig.exe no specs winload.exe no specs utilman.exe no specs control.exe no specs netcfg.exe no specs locationnotifications.exe no specs optionalfeatures.exe no specs rmactivate_ssp.exe no specs iexpress.exe logagent.exe no specs services.exe no specs ntkrnlpa.exe no specs imjpdsvr.exe no specs werfaultsecure.exe no specs relog.exe no specs pathping.exe no specs dvdmaker.exe no specs logman.exe no specs wmpnscfg.exe no specs vssvc.exe no specs iscsicpl.exe no specs ntkrnlpa.exe no specs bonzify.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376INSTALLER.exe /qC:\Users\admin\AppData\Local\Temp\INSTALLER.exe—Bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
4.71.1015.0
Modules
Images
c:\users\admin\appdata\local\temp\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
796regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"C:\Windows\System32\regsvr32.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996grpconv.exe -oC:\Windows\System32\grpconv.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996"C:\Windows\System32\sbunattend.exe"C:\Windows\System32\sbunattend.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Sidebar Unattend Action
Exit code:
3221225794
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sbunattend.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
1220"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 328C:\Program Files\Common Files\microsoft shared\DW\DW20.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Application Error Reporting
Exit code:
3221226356
Version:
14.0.6015.1000
Modules
Images
c:\program files\common files\microsoft shared\dw\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1432"C:\Windows\System32\OptionalFeatures.exe"C:\Windows\System32\OptionalFeatures.exe—LocationNotifications.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Features
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\optionalfeatures.exe
c:\windows\system32\ntdll.dll
1560icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1576"C:\Users\admin\Desktop\Bonzify.exe" C:\Users\admin\Desktop\Bonzify.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\bonzify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1652"C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe"C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ComSvcConfig.exe
Exit code:
0
Version:
3.0.4506.5420 (Win7SP1.030729-5400)
Modules
Images
c:\windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\comsvcconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1792C:\Windows\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\KillAgent.bat"C:\Windows\System32\cmd.exe—Bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 768
Read events
3 521
Write events
1 091
Delete events
156

Modification events

(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Control
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus\1
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Programmable
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ToolboxBitmap32
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\TypeLib
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Version
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\VersionIndependentProgID
Operation:delete keyName:(default)
Value:
Executable files
55
Suspicious files
26
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\TakeOwn.battext
MD5:E5F461B27469D58FCFFDAEA1BA1E0172
SHA256:8EA7E9F2130A1B1ACA020740E8F81623761EFAA3F5FE0D34C730F4641480250D
1576Bonzify.exeC:\Windows\executables.binbinary
MD5:F3160BA7F8BB9D7A9C6080EF2C9869C5
SHA256:F6A3286714A661612EAC65E4A6CB78736C370492151B692A8F1E666740C0A00E
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLexecutable
MD5:316999655FEF30C52C3854751C663996
SHA256:EA4CA740CD60D2C88280FF8115BF354876478EF27E9E676D8B66601B4E900BA0
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\INSTALLER.exeexecutable
MD5:66996A076065EBDCDAC85FF9637CEAE0
SHA256:16CA09AD70561F413376AD72550AE5664C89C6A76C85C872FFE2CB1E7F49E2AA
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLLexecutable
MD5:237E13B95AB37D0141CF0BC585B8DB94
SHA256:D19B6B7C57BCEE7239526339E683F62D9C2F9690947D0A446001377F0B56103A
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLLexecutable
MD5:9FAFB9D0591F2BE4C2A846F63D82D301
SHA256:E78E74C24D468284639FAF9DCFDBA855F3E4F00B2F26DB6B2C491FA51DA8916D
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INFbinary
MD5:B127D9187C6DBB1B948053C7C9A6811F
SHA256:BD1295D19D010D4866C9D6D87877913EEE69E279D4D089E5756BA285F3424E00
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\KillAgent.battext
MD5:6EA65B32F50D5B71FBB6557CDBBFDA10
SHA256:66E35917FAFA086C45BBABC1D22AC08DB935952F7026DBD5E9CC9EC1673F19AB
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLLexecutable
MD5:48C00A7493B28139CBF197CCC8D1F9ED
SHA256:905CB1A15ECCAA9B79926EE7CFE3629A6F1C6B24BDD6CEA9CCB9EBC9EAA92FF7
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXEexecutable
MD5:5C91BF20FE3594B81052D131DB798575
SHA256:E8CE546196B6878A8C34DA863A6C8A7E34AF18FB9B509D4D36763734EFA2D175
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3616
dplaysvr.exe
192.168.100.2:1900
—
—
—
whitelisted
2036
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
Process
Message
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
UnclaimOutput
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bonzify.exe