| URL: | http://dl.bandisoft.com/bandizip/BANDIZIP-SETUP.EXE |
| Full analysis: | https://app.any.run/tasks/ac12811d-c901-4102-9df3-877419a8e314 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 19, 2019, 07:14:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 177C65F595184ED77C081115C96C5548 |
| SHA1: | BF7536AB5CF0F1A8AC71DADA93E7120AE63D8EF7 |
| SHA256: | F4AFDC7B8B15F9BCB61F1E333BF6985D55749A8D7817CA4CEB1DEB3942A7CB77 |
| SSDEEP: | 3:N1KaJW9KDtGGCBekrhes10lgn:CaJWoXCBekrU7lg |
MALICIOUS
Downloads executable files from the Internet
- chrome.exe (PID: 2996)
Application was dropped or rewritten from another process
- BANDIZIP-SETUP.EXE (PID: 3016)
- BANDIZIP-SETUP.EXE (PID: 2860)
- RegDll32.exe (PID: 2160)
- Bandizip.exe (PID: 3468)
- RegDll32.exe (PID: 2616)
- RegDll32.exe (PID: 3292)
- RegDll32.exe (PID: 4016)
- RegDll32.exe (PID: 3128)
- Bandizip.exe (PID: 4068)
- Bandizip.exe (PID: 3540)
- updater.exe (PID: 348)
Loads dropped or rewritten executable
- RegDll32.exe (PID: 4016)
- svchost.exe (PID: 844)
- chrome.exe (PID: 4000)
SUSPICIOUS
Executable content was dropped or overwritten
- chrome.exe (PID: 2996)
- BANDIZIP-SETUP.EXE (PID: 2860)
Creates files in the user directory
- BANDIZIP-SETUP.EXE (PID: 2860)
- updater.exe (PID: 348)
Changes IE settings (feature browser emulation)
- RegDll32.exe (PID: 3292)
- RegDll32.exe (PID: 2160)
Creates COM task schedule object
- RegDll32.exe (PID: 4016)
Creates files in the program directory
- BANDIZIP-SETUP.EXE (PID: 2860)
Modifies the open verb of a shell class
- Bandizip.exe (PID: 3540)
- BANDIZIP-SETUP.EXE (PID: 2860)
- Bandizip.exe (PID: 3468)
Reads internet explorer settings
- updater.exe (PID: 348)
Creates a software uninstall entry
- BANDIZIP-SETUP.EXE (PID: 2860)
INFO
Application launched itself
- chrome.exe (PID: 2996)
Reads Internet Cache Settings
- chrome.exe (PID: 2996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
54
Monitored processes
23
Malicious processes
7
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 348 | "C:\Program Files\Bandizip\updater.exe" /nosleep | C:\Program Files\Bandizip\updater.exe | Bandizip.exe | ||||||||||||
User: admin Company: Bandisoft.com Integrity Level: MEDIUM Description: Bandizip Updater Exit code: 0 Version: 6.22.0.1 Modules
| |||||||||||||||
| 844 | C:\Windows\system32\svchost.exe -k netsvcs | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1716 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=960,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=AA494380577D90A2CDEFA9D0D1E41C19 --mojo-platform-channel-handle=1008 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2124 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=386C4D74C4A4634A44C25F1748D5F696 --mojo-platform-channel-handle=1196 --ignored=" --type=renderer " /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2160 | "C:\Program Files\Bandizip\data/RegDll32.exe" /regieemulation Bandizip.exe | C:\Program Files\Bandizip\data\RegDll32.exe | — | BANDIZIP-SETUP.EXE | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2560 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=960,6648249723427096982,15695952238347034389,131072 --enable-features=PasswordImport --service-pipe-token=7902E1C7612ABD71EF83087B4AAD65DB --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7902E1C7612ABD71EF83087B4AAD65DB --renderer-client-id=4 --mojo-platform-channel-handle=1884 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 2616 | "C:\Program Files\Bandizip\data/RegDll32.exe" /addpath "C:\Program Files\Bandizip\" | C:\Program Files\Bandizip\data\RegDll32.exe | — | BANDIZIP-SETUP.EXE | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2764 | C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding | C:\Windows\explorer.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2860 | "C:\Users\admin\Downloads\BANDIZIP-SETUP.EXE" | C:\Users\admin\Downloads\BANDIZIP-SETUP.EXE | chrome.exe | ||||||||||||
User: admin Company: Bandisoft Integrity Level: HIGH Description: Bandizip 6.22 Setup Exit code: 0 Version: 6.22 Modules
| |||||||||||||||
| 2956 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3000 --on-initialized-event-handle=304 --parent-handle=308 /prefetch:6 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
Total events
2 532
Read events
1 236
Write events
1 293
Delete events
3
Modification events
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (2956) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 2996-13197453276529500 |
Value: 259 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 3516-13180984670829101 |
Value: 0 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 2996-13197453276529500 |
Value: 259 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (2996) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | metricsid |
Value: | |||
Executable files
13
Suspicious files
26
Text files
142
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\a4c806f6-671a-4ad9-9aa7-97d793cbf183.tmp | — | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\66bc989d-3df1-4251-853a-7eb307141134.tmp | — | |
MD5:— | SHA256:— | |||
| 844 | svchost.exe | C:\Windows\appcompat\programs\RecentFileCache.bcf | txt | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\Downloads\8a17f984-03b6-4345-bba9-d8b4be4bfece.tmp | — | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ec91000a-9a3a-41e0-bb4a-43453a43b03c.tmp | — | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2996 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF20e40b.TMP | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
12
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2996 | chrome.exe | GET | 200 | 52.47.85.156:80 | http://dl.bandisoft.com/bandizip/BANDIZIP-SETUP.EXE | FR | executable | 6.23 Mb | suspicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2996 | chrome.exe | 172.217.23.163:443 | www.gstatic.com | Google Inc. | US | whitelisted |
2996 | chrome.exe | 52.47.85.156:80 | dl.bandisoft.com | Amazon.com, Inc. | FR | suspicious |
2996 | chrome.exe | 216.58.208.35:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
348 | updater.exe | 52.78.169.250:443 | ver.bandi.so | Amazon.com, Inc. | KR | suspicious |
348 | updater.exe | 172.217.18.104:443 | ssl.google-analytics.com | Google Inc. | US | suspicious |
2996 | chrome.exe | 216.58.207.42:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2996 | chrome.exe | 172.217.16.142:443 | clients1.google.com | Google Inc. | US | whitelisted |
2996 | chrome.exe | 216.58.207.67:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2996 | chrome.exe | 172.217.22.78:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
2860 | BANDIZIP-SETUP.EXE | 52.78.169.250:443 | ver.bandi.so | Amazon.com, Inc. | KR | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
dl.bandisoft.com |
| suspicious |
accounts.google.com |
| shared |
sb-ssl.google.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
ver.bandi.so |
| suspicious |
log.bandi.so |
| suspicious |
ana.bandi.so |
| suspicious |
ssl.google-analytics.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2996 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2996 | chrome.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
Process | Message |
|---|---|
Bandizip.exe | ========= HANDLE LEAK CHECK ===============================
|
Bandizip.exe | ========= Handle Leak Check: 36 -> 45 (9)
|
Bandizip.exe | ===========================================================
|
Bandizip.exe | ========= HANDLE LEAK CHECK ===============================
|
Bandizip.exe | ========= Handle Leak Check: 36 -> 45 (9)
|
Bandizip.exe | ===========================================================
|