Overview
overview
10Static
static
7BUG32.exe
windows7-x64
BUG32.exe
windows10-2004-x64
Windows/Bonzify.exe
windows7-x64
8Windows/Bonzify.exe
windows10-2004-x64
8BossDaMajor.exe
windows7-x64
BossDaMajor.exe
windows10-2004-x64
Happy99.exe
windows7-x64
5Happy99.exe
windows10-2004-x64
5Magistr.exe
windows7-x64
1Magistr.exe
windows10-2004-x64
1Maldal.exe
windows7-x64
5Maldal.exe
windows10-2004-x64
5MeltingScreen.exe
windows7-x64
1MeltingScreen.exe
windows10-2004-x64
1Windows/Ra...ac.exe
windows7-x64
Windows/Ra...ac.exe
windows10-2004-x64
Windows/Ra...it.exe
windows7-x64
10Windows/Ra...it.exe
windows10-2004-x64
10Windows/Ra...or.exe
windows7-x64
Windows/Ra...or.exe
windows10-2004-x64
Windows/Ra...on.exe
windows7-x64
10Windows/Ra...on.exe
windows10-2004-x64
7Windows/Ra...ye.exe
windows7-x64
10Windows/Ra...ye.exe
windows10-2004-x64
10Windows/Ra...Eye.js
windows7-x64
10Windows/Ra...Eye.js
windows10-2004-x64
10Windows/Ra...ya.exe
windows7-x64
10Windows/Ra...ya.exe
windows10-2004-x64
10Windows/Ra...om.exe
windows7-x64
1Windows/Ra...om.exe
windows10-2004-x64
1Windows/Ra...om.exe
windows7-x64
3Windows/Ra...om.exe
windows10-2004-x64
3Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 22:32
Behavioral task
behavioral1
Sample
BUG32.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BUG32.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Windows/Bonzify.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Windows/Bonzify.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
BossDaMajor.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
BossDaMajor.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Happy99.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Happy99.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Magistr.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Magistr.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Maldal.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Maldal.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
MeltingScreen.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
MeltingScreen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Windows/Ransomware/Monster Ransomware/XMoon.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Windows/Ransomware/Monster Ransomware/XMoon.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win10v2004-20240226-en
General
-
Target
Windows/Bonzify.exe
-
Size
6.4MB
-
MD5
9c352d2ce0c0bdc40c72f52ce3480577
-
SHA1
bd4c956186f33c92eb4469f7e5675510d0790e99
-
SHA256
d7e6580054525d3f21f86edfc9f30b7a75ffa829a1eb67ee3cab33f0040dba4e
-
SHA512
c1926d59272df0e049467f4497bcc3631bbc1aa5337e87f4af31bfdba60c9ef460e394380024ffa7e71fef8938761d48d75e9dc93dc7529d2b9c8c638dddae92
-
SSDEEP
196608:/dAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:naWedh+Idx75QYub//73lc6u7bLMYxD
Malware Config
Signatures
-
Possible privilege escalation attempt 2 IoCs
pid Process 4136 takeown.exe 2576 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 4136 takeown.exe 2576 icacls.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\executables.bin Bonzify.exe -
Kills process with taskkill 1 IoCs
pid Process 2788 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2788 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2652 wrote to memory of 3904 2652 Bonzify.exe 88 PID 2652 wrote to memory of 3904 2652 Bonzify.exe 88 PID 2652 wrote to memory of 3904 2652 Bonzify.exe 88 PID 3904 wrote to memory of 2788 3904 cmd.exe 90 PID 3904 wrote to memory of 2788 3904 cmd.exe 90 PID 3904 wrote to memory of 2788 3904 cmd.exe 90 PID 3904 wrote to memory of 4136 3904 cmd.exe 92 PID 3904 wrote to memory of 4136 3904 cmd.exe 92 PID 3904 wrote to memory of 4136 3904 cmd.exe 92 PID 3904 wrote to memory of 2576 3904 cmd.exe 93 PID 3904 wrote to memory of 2576 3904 cmd.exe 93 PID 3904 wrote to memory of 2576 3904 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe"C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im AgentSvr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\SysWOW64\takeown.exetakeown /r /d y /f C:\Windows\MsAgent3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4136
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\MsAgent /c /t /grant "everyone":(f)3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
161B
MD5ea7df060b402326b4305241f21f39736
SHA17d58fb4c58e0edb2ddceef4d21581ff9d512fdc2
SHA256e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793
SHA5123147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0