General

  • Target

    Bonzify.zip

  • Size

    5.6MB

  • Sample

    230117-w1s1zagg21

  • MD5

    476b2ef2354fc0b619fe0ed297b4c314

  • SHA1

    1a4fa699300a99b2f22c061010bbf18090bec83e

  • SHA256

    9ef92c016571af585947b08f53ec13d6c34833bac6924aa7b556506fbf407609

  • SHA512

    9d5ac0ed54c81fee24d7cde88fe5297d2d22398f97eb40e862c4e496433498141d28621f8ec6c5bbf6ddc229ab1373b3a09ab577ffa4f2ca53ac614d1a8104e7

  • SSDEEP

    98304:5Yry2CySsWxBow+gdIKa77AULjdVaNVDx/P49JmP62t5+p5Znmo4nKLQG0WyPs:5KyzdxqgdIRAQjdCx/A9J862twHZnmol

Malware Config

Targets

    • Target

      Bonzify.exe

    • Size

      6.4MB

    • MD5

      fba93d8d029e85e0cde3759b7903cee2

    • SHA1

      525b1aa549188f4565c75ab69e51f927204ca384

    • SHA256

      66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764

    • SHA512

      7c1441b2e804e925eb5a03e97db620117d3ad4f6981dc020e4e7df4bfc4bd6e414fa3b0ce764481a2cef07eebb2baa87407355bfbe88fab96397d82bd441e6a2

    • SSDEEP

      196608:adAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:OaWedh+Idx75QYub//73lc6u7bLMYxD

    • Executes dropped EXE

    • Modifies AppInit DLL entries

    • Modifies Installed Components in the registry

    • Possible privilege escalation attempt

    • Loads dropped DLL

    • Modifies file permissions

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

3
T1060

Defense Evasion

Modify Registry

3
T1112

File Permissions Modification

1
T1222

Discovery

Query Registry

1
T1012

Tasks