File name:

Bonzify.exe

Full analysis: https://app.any.run/tasks/f6e83450-2f08-48b0-961c-b007c049afb4
Verdict: Malicious activity
Analysis date: January 06, 2024, 00:28:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7E5FBEA7EE5A03D2C6DEE20854DEED2E

SHA1:

E3D6D23BACC182E8036FB5E38D9E8FD26830045C

SHA256:

E369B688C86695960657DCF3CF63626C8C47095832C4A85E2D317E31AB8EF497

SSDEEP:

98304:5YFIsQd4i6QcdsbjxHqi/iXrPFt4BZkHj+Ml8TV9EFvxiKJT+7L51fo6bxHKrDWt:5yQ8nQqClXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Creates a writable file in the system directory

      • INSTALLER.exe (PID: 376)

    • Changes the AppInit_DLLs value (autorun option)

      • Bonzify.exe (PID: 1576)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 3248)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1792)

    • Starts CMD.EXE for commands execution

      • Bonzify.exe (PID: 1576)

    • Executing commands from a ".bat" file

      • Bonzify.exe (PID: 1576)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 1792)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1792)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 796)
      • WINWORD.EXE (PID: 3248)
      • iexpress.exe (PID: 4996)

    • Changes internet zones settings

      • WINWORD.EXE (PID: 3248)
      • iexpress.exe (PID: 4996)

    • Process changes security settings for the VBA macro

      • iexpress.exe (PID: 4996)

  • INFO

    • Create files in a temporary directory

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Drops the executable file immediately after the start

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Checks supported languages

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • AgentSvr.exe (PID: 2592)
      • INSTALLER.exe (PID: 376)
      • AgentSvr.exe (PID: 2052)
      • wmpnscfg.exe (PID: 3120)
      • wmpnscfg.exe (PID: 2988)
      • DW20.EXE (PID: 1220)
      • wbemtest.exe (PID: 3228)
      • Utilman.exe (PID: 2632)
      • IMJPMGR.EXE (PID: 3600)
      • services.exe (PID: 5868)
      • iexpress.exe (PID: 4996)
      • IMJPDSVR.EXE (PID: 2292)
      • ComSvcConfig.exe (PID: 1652)

    • Process drops legitimate windows executable

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Reads the computer name

      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)
      • Bonzify.exe (PID: 1576)
      • AgentSvr.exe (PID: 2052)
      • wmpnscfg.exe (PID: 3120)
      • wmpnscfg.exe (PID: 2988)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • services.exe (PID: 5868)

    • Reads the machine GUID from the registry

      • AgentSvr.exe (PID: 2052)
      • Bonzify.exe (PID: 1576)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • iexpress.exe (PID: 4996)
      • services.exe (PID: 5868)
      • Utilman.exe (PID: 2632)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3120)
      • wmpnscfg.exe (PID: 2988)
      • WINWORD.EXE (PID: 3248)
      • wbemtest.exe (PID: 3228)
      • Utilman.exe (PID: 2632)
      • pcwrun.exe (PID: 3904)
      • ktmutil.exe (PID: 2312)
      • IMJPMGR.EXE (PID: 3600)
      • ComSvcConfig.exe (PID: 1652)
      • vmicsvc.exe (PID: 2740)
      • netcfg.exe (PID: 2724)
      • control.exe (PID: 2952)
      • LocationNotifications.exe (PID: 3084)
      • RMActivate_ssp.exe (PID: 4516)
      • iexpress.exe (PID: 4996)
      • services.exe (PID: 5868)
      • WerFaultSecure.exe (PID: 2736)
      • relog.exe (PID: 5160)
      • wmpnscfg.exe (PID: 5320)
      • ntkrnlpa.exe (PID: 2260)
      • iscsicpl.exe (PID: 5988)
      • DVDMaker.exe (PID: 5796)
      • logman.exe (PID: 4184)

    • Process checks are UAC notifies on

      • IMJPMGR.EXE (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (80.4)
.exe | Win32 Executable MS Visual C++ (generic) (8.2)
.exe | Win64 Executable (generic) (7.3)
.dll | Win32 Dynamic Link Library (generic) (1.7)
.exe | Win32 Executable (generic) (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:11:07 19:29:20+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 4096
InitializedDataSize: 3719680
UninitializedDataSize: -
EntryPoint: 0x16b0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
436
Monitored processes
55
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bonzify.exe cmd.exe no specs taskkill.exe no specs takeown.exe no specs icacls.exe no specs installer.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs agentsvr.exe no specs grpconv.exe no specs installer.exe no specs regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs agentsvr.exe wmpnscfg.exe no specs wmpnscfg.exe no specs winword.exe no specs vmicsvc.exe no specs sbunattend.exe no specs dw20.exe no specs dwwin.exe wbemtest.exe no specs perfmon.exe no specs pcwrun.exe no specs ktmutil.exe no specs imjpmgr.exe no specs comsvcconfig.exe no specs winload.exe no specs utilman.exe no specs control.exe no specs netcfg.exe no specs locationnotifications.exe no specs optionalfeatures.exe no specs rmactivate_ssp.exe no specs iexpress.exe logagent.exe no specs services.exe no specs ntkrnlpa.exe no specs imjpdsvr.exe no specs werfaultsecure.exe no specs relog.exe no specs pathping.exe no specs dvdmaker.exe no specs logman.exe no specs wmpnscfg.exe no specs vssvc.exe no specs iscsicpl.exe no specs ntkrnlpa.exe no specs bonzify.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376INSTALLER.exe /qC:\Users\admin\AppData\Local\Temp\INSTALLER.exe—Bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
4.71.1015.0
Modules
Images
c:\users\admin\appdata\local\temp\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
796regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"C:\Windows\System32\regsvr32.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996grpconv.exe -oC:\Windows\System32\grpconv.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996"C:\Windows\System32\sbunattend.exe"C:\Windows\System32\sbunattend.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Sidebar Unattend Action
Exit code:
3221225794
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sbunattend.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
1220"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 328C:\Program Files\Common Files\microsoft shared\DW\DW20.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Application Error Reporting
Exit code:
3221226356
Version:
14.0.6015.1000
Modules
Images
c:\program files\common files\microsoft shared\dw\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1432"C:\Windows\System32\OptionalFeatures.exe"C:\Windows\System32\OptionalFeatures.exe—LocationNotifications.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Features
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\optionalfeatures.exe
c:\windows\system32\ntdll.dll
1560icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1576"C:\Users\admin\Desktop\Bonzify.exe" C:\Users\admin\Desktop\Bonzify.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\bonzify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1652"C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe"C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ComSvcConfig.exe
Exit code:
0
Version:
3.0.4506.5420 (Win7SP1.030729-5400)
Modules
Images
c:\windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\comsvcconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1792C:\Windows\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\KillAgent.bat"C:\Windows\System32\cmd.exe—Bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 768
Read events
3 521
Write events
1 091
Delete events
156

Modification events

(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Control
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus\1
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Programmable
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ToolboxBitmap32
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\TypeLib
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Version
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\VersionIndependentProgID
Operation:delete keyName:(default)
Value:
Executable files
55
Suspicious files
26
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\TakeOwn.battext
MD5:E5F461B27469D58FCFFDAEA1BA1E0172
SHA256:8EA7E9F2130A1B1ACA020740E8F81623761EFAA3F5FE0D34C730F4641480250D
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\INSTALLER.exeexecutable
MD5:66996A076065EBDCDAC85FF9637CEAE0
SHA256:16CA09AD70561F413376AD72550AE5664C89C6A76C85C872FFE2CB1E7F49E2AA
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLexecutable
MD5:316999655FEF30C52C3854751C663996
SHA256:EA4CA740CD60D2C88280FF8115BF354876478EF27E9E676D8B66601B4E900BA0
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLLexecutable
MD5:A334BBF5F5A19B3BDB5B7F1703363981
SHA256:C33BEABA130F8B740DDDB9980FE9012F9322AC6E94F36A6AA6086851C51B98DE
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLLexecutable
MD5:9FAFB9D0591F2BE4C2A846F63D82D301
SHA256:E78E74C24D468284639FAF9DCFDBA855F3E4F00B2F26DB6B2C491FA51DA8916D
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLLexecutable
MD5:0CBF0F4C9E54D12D34CD1A772BA799E1
SHA256:6B0B57E5B27D901F4F106B236C58D0B2551B384531A8F3DAD6C06ED4261424B1
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLLexecutable
MD5:B4AC608EBF5A8FDEFA2D635E83B7C0E8
SHA256:8414DFE399813B7426C235BA1E625BD2B5635C8140DA0D0CFC947F6565FE415F
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLLexecutable
MD5:48C00A7493B28139CBF197CCC8D1F9ED
SHA256:905CB1A15ECCAA9B79926EE7CFE3629A6F1C6B24BDD6CEA9CCB9EBC9EAA92FF7
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLBexecutable
MD5:F1656B80EAAE5E5201DCBFBCD3523691
SHA256:3F8ADC1E332DD5C252BBCF92BF6079B38A74D360D94979169206DB34E6A24CD2
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXEexecutable
MD5:5C91BF20FE3594B81052D131DB798575
SHA256:E8CE546196B6878A8C34DA863A6C8A7E34AF18FB9B509D4D36763734EFA2D175
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3616
dplaysvr.exe
192.168.100.2:1900
—
—
—
whitelisted
2036
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
Process
Message
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
UnclaimOutput
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bonzify.exe