1473050bbfaaccabbc5429d25b37bbeaf0d73eb39706e9b01d88494704447ded

Analysis

max time kernel
152s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows/Bonzify.exe
Size

6.4MB
MD5

9c352d2ce0c0bdc40c72f52ce3480577
SHA1

bd4c956186f33c92eb4469f7e5675510d0790e99
SHA256

d7e6580054525d3f21f86edfc9f30b7a75ffa829a1eb67ee3cab33f0040dba4e
SHA512

c1926d59272df0e049467f4497bcc3631bbc1aa5337e87f4af31bfdba60c9ef460e394380024ffa7e71fef8938761d48d75e9dc93dc7529d2b9c8c638dddae92
SSDEEP

196608:/dAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:naWedh+Idx75QYub//73lc6u7bLMYxD

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2948	icacls.exe
2372	takeown.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2372	takeown.exe
2948	icacls.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\executables.bin	Bonzify.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2468	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2468	taskkill.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2984	1504	Bonzify.exe	28
PID 1504 wrote to memory of 2984	1504	Bonzify.exe	28
PID 1504 wrote to memory of 2984	1504	Bonzify.exe	28
PID 1504 wrote to memory of 2984	1504	Bonzify.exe	28
PID 2984 wrote to memory of 2468	2984	cmd.exe	30
PID 2984 wrote to memory of 2468	2984	cmd.exe	30
PID 2984 wrote to memory of 2468	2984	cmd.exe	30
PID 2984 wrote to memory of 2468	2984	cmd.exe	30
PID 2984 wrote to memory of 2372	2984	cmd.exe	32
PID 2984 wrote to memory of 2372	2984	cmd.exe	32
PID 2984 wrote to memory of 2372	2984	cmd.exe	32
PID 2984 wrote to memory of 2372	2984	cmd.exe	32
PID 2984 wrote to memory of 2948	2984	cmd.exe	33
PID 2984 wrote to memory of 2948	2984	cmd.exe	33
PID 2984 wrote to memory of 2948	2984	cmd.exe	33
PID 2984 wrote to memory of 2948	2984	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AgentSvr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2468
- - C:\Windows\SysWOW64\takeown.exe
    takeown /r /d y /f C:\Windows\MsAgent
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2372
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KillAgent.bat

Filesize
161B

MD5
ea7df060b402326b4305241f21f39736

SHA1
7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

SHA256
e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

SHA512
3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

Download Submit