General

  • Target

    https://github.com/TheDarkMythos/windows-malware/blob/master/BonziBuddy/BonziBuddy432.exe

  • Sample

    240226-bwp4ashd77

Malware Config

Targets

    • Target

      https://github.com/TheDarkMythos/windows-malware/blob/master/BonziBuddy/BonziBuddy432.exe

    • Downloads MZ/PE file

    • Modifies Installed Components in the registry

    • Possible privilege escalation attempt

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks