File name:

Bonzify.exe

Full analysis: https://app.any.run/tasks/f6e83450-2f08-48b0-961c-b007c049afb4
Verdict: Malicious activity
Analysis date: January 06, 2024, 00:28:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7E5FBEA7EE5A03D2C6DEE20854DEED2E

SHA1:

E3D6D23BACC182E8036FB5E38D9E8FD26830045C

SHA256:

E369B688C86695960657DCF3CF63626C8C47095832C4A85E2D317E31AB8EF497

SSDEEP:

98304:5YFIsQd4i6QcdsbjxHqi/iXrPFt4BZkHj+Ml8TV9EFvxiKJT+7L51fo6bxHKrDWt:5yQ8nQqClXF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Creates a writable file in the system directory

      • INSTALLER.exe (PID: 376)

    • Changes the AppInit_DLLs value (autorun option)

      • Bonzify.exe (PID: 1576)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 3248)

  • SUSPICIOUS

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 1792)

    • Executing commands from a ".bat" file

      • Bonzify.exe (PID: 1576)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1792)

    • Starts CMD.EXE for commands execution

      • Bonzify.exe (PID: 1576)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1792)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 796)
      • WINWORD.EXE (PID: 3248)
      • iexpress.exe (PID: 4996)

    • Changes internet zones settings

      • WINWORD.EXE (PID: 3248)
      • iexpress.exe (PID: 4996)

    • Process changes security settings for the VBA macro

      • iexpress.exe (PID: 4996)

  • INFO

    • Drops the executable file immediately after the start

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Checks supported languages

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)
      • AgentSvr.exe (PID: 2052)
      • wmpnscfg.exe (PID: 3120)
      • wmpnscfg.exe (PID: 2988)
      • DW20.EXE (PID: 1220)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • Utilman.exe (PID: 2632)
      • ComSvcConfig.exe (PID: 1652)
      • iexpress.exe (PID: 4996)
      • services.exe (PID: 5868)
      • IMJPDSVR.EXE (PID: 2292)
      • AgentSvr.exe (PID: 2592)

    • Create files in a temporary directory

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Process drops legitimate windows executable

      • Bonzify.exe (PID: 1576)
      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)

    • Reads the computer name

      • INSTALLER.exe (PID: 1844)
      • INSTALLER.exe (PID: 376)
      • Bonzify.exe (PID: 1576)
      • AgentSvr.exe (PID: 2052)
      • wmpnscfg.exe (PID: 3120)
      • wmpnscfg.exe (PID: 2988)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • services.exe (PID: 5868)

    • Reads the machine GUID from the registry

      • Bonzify.exe (PID: 1576)
      • AgentSvr.exe (PID: 2052)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • iexpress.exe (PID: 4996)
      • Utilman.exe (PID: 2632)
      • services.exe (PID: 5868)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3120)
      • wmpnscfg.exe (PID: 2988)
      • WINWORD.EXE (PID: 3248)
      • vmicsvc.exe (PID: 2740)
      • wbemtest.exe (PID: 3228)
      • IMJPMGR.EXE (PID: 3600)
      • ktmutil.exe (PID: 2312)
      • Utilman.exe (PID: 2632)
      • control.exe (PID: 2952)
      • LocationNotifications.exe (PID: 3084)
      • netcfg.exe (PID: 2724)
      • iexpress.exe (PID: 4996)
      • RMActivate_ssp.exe (PID: 4516)
      • services.exe (PID: 5868)
      • ComSvcConfig.exe (PID: 1652)
      • WerFaultSecure.exe (PID: 2736)
      • DVDMaker.exe (PID: 5796)
      • relog.exe (PID: 5160)
      • iscsicpl.exe (PID: 5988)
      • logman.exe (PID: 4184)
      • wmpnscfg.exe (PID: 5320)
      • ntkrnlpa.exe (PID: 2260)
      • pcwrun.exe (PID: 3904)

    • Process checks are UAC notifies on

      • IMJPMGR.EXE (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (80.4)
.exe | Win32 Executable MS Visual C++ (generic) (8.2)
.exe | Win64 Executable (generic) (7.3)
.dll | Win32 Dynamic Link Library (generic) (1.7)
.exe | Win32 Executable (generic) (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:11:07 19:29:20+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 4096
InitializedDataSize: 3719680
UninitializedDataSize: -
EntryPoint: 0x16b0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
436
Monitored processes
55
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start bonzify.exe cmd.exe no specs taskkill.exe no specs takeown.exe no specs icacls.exe no specs installer.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs agentsvr.exe no specs grpconv.exe no specs installer.exe no specs regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs agentsvr.exe wmpnscfg.exe no specs wmpnscfg.exe no specs winword.exe no specs vmicsvc.exe no specs sbunattend.exe no specs dw20.exe no specs dwwin.exe wbemtest.exe no specs perfmon.exe no specs pcwrun.exe no specs ktmutil.exe no specs imjpmgr.exe no specs comsvcconfig.exe no specs winload.exe no specs utilman.exe no specs control.exe no specs netcfg.exe no specs locationnotifications.exe no specs optionalfeatures.exe no specs rmactivate_ssp.exe no specs iexpress.exe logagent.exe no specs services.exe no specs ntkrnlpa.exe no specs imjpdsvr.exe no specs werfaultsecure.exe no specs relog.exe no specs pathping.exe no specs dvdmaker.exe no specs logman.exe no specs wmpnscfg.exe no specs vssvc.exe no specs iscsicpl.exe no specs ntkrnlpa.exe no specs bonzify.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376INSTALLER.exe /qC:\Users\admin\AppData\Local\Temp\INSTALLER.exe—Bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
4.71.1015.0
Modules
Images
c:\users\admin\appdata\local\temp\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
796regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"C:\Windows\System32\regsvr32.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996grpconv.exe -oC:\Windows\System32\grpconv.exe—INSTALLER.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\grpconv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996"C:\Windows\System32\sbunattend.exe"C:\Windows\System32\sbunattend.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Sidebar Unattend Action
Exit code:
3221225794
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sbunattend.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
1220"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 328C:\Program Files\Common Files\microsoft shared\DW\DW20.EXE—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Application Error Reporting
Exit code:
3221226356
Version:
14.0.6015.1000
Modules
Images
c:\program files\common files\microsoft shared\dw\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1432"C:\Windows\System32\OptionalFeatures.exe"C:\Windows\System32\OptionalFeatures.exe—LocationNotifications.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Features
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\optionalfeatures.exe
c:\windows\system32\ntdll.dll
1560icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1576"C:\Users\admin\Desktop\Bonzify.exe" C:\Users\admin\Desktop\Bonzify.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\bonzify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1652"C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe"C:\Windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\ComSvcConfig.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ComSvcConfig.exe
Exit code:
0
Version:
3.0.4506.5420 (Win7SP1.030729-5400)
Modules
Images
c:\windows\winsxs\msil_comsvcconfig_b03f5f7f11d50a3a_6.1.7601.17514_none_bfe4d387913dbb8f\comsvcconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1792C:\Windows\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\KillAgent.bat"C:\Windows\System32\cmd.exe—Bonzify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 768
Read events
3 521
Write events
1 091
Delete events
156

Modification events

(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Control
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus\1
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Programmable
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ToolboxBitmap32
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\TypeLib
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\Version
Operation:delete keyName:(default)
Value:
(PID) Process:(796) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\VersionIndependentProgID
Operation:delete keyName:(default)
Value:
Executable files
55
Suspicious files
26
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\KillAgent.battext
MD5:6EA65B32F50D5B71FBB6557CDBBFDA10
SHA256:66E35917FAFA086C45BBABC1D22AC08DB935952F7026DBD5E9CC9EC1673F19AB
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLLexecutable
MD5:48C00A7493B28139CBF197CCC8D1F9ED
SHA256:905CB1A15ECCAA9B79926EE7CFE3629A6F1C6B24BDD6CEA9CCB9EBC9EAA92FF7
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLLexecutable
MD5:4FBBAAC42CF2ECB83543F262973D07C0
SHA256:6550582E41FC53B8A7CCDF9AC603216937C6FF2A28E9538610ADB7E67D782AB5
1576Bonzify.exeC:\Users\admin\AppData\Local\Temp\TakeOwn.battext
MD5:E5F461B27469D58FCFFDAEA1BA1E0172
SHA256:8EA7E9F2130A1B1ACA020740E8F81623761EFAA3F5FE0D34C730F4641480250D
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLLexecutable
MD5:316999655FEF30C52C3854751C663996
SHA256:EA4CA740CD60D2C88280FF8115BF354876478EF27E9E676D8B66601B4E900BA0
1576Bonzify.exeC:\Windows\executables.binbinary
MD5:F3160BA7F8BB9D7A9C6080EF2C9869C5
SHA256:F6A3286714A661612EAC65E4A6CB78736C370492151B692A8F1E666740C0A00E
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLLexecutable
MD5:A334BBF5F5A19B3BDB5B7F1703363981
SHA256:C33BEABA130F8B740DDDB9980FE9012F9322AC6E94F36A6AA6086851C51B98DE
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLLexecutable
MD5:7C5AEFB11E797129C9E90F279FBDF71B
SHA256:394A17150B8774E507B8F368C2C248C10FCE50FC43184B744E771F0E79ECAFED
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INFbinary
MD5:B127D9187C6DBB1B948053C7C9A6811F
SHA256:BD1295D19D010D4866C9D6D87877913EEE69E279D4D089E5756BA285F3424E00
1844INSTALLER.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLLexecutable
MD5:81E5C8596A7E4E98117F5C5143293020
SHA256:7D126ED85DF9705EC4F38BD52A73B621CF64DD87A3E8F9429A569F3F82F74004
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3616
dplaysvr.exe
192.168.100.2:1900
—
—
—
whitelisted
2036
WerFault.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted

Threats

No threats detected
Process
Message
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
ClaimOutput
AgentSvr.exe
UnclaimOutput
AgentSvr.exe
UnclaimOutput
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Bonzify.exe