1473050bbfaaccabbc5429d25b37bbeaf0d73eb39706e9b01d88494704447ded

Analysis

max time kernel
181s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows/Bonzify.exe
Size

6.4MB
MD5

9c352d2ce0c0bdc40c72f52ce3480577
SHA1

bd4c956186f33c92eb4469f7e5675510d0790e99
SHA256

d7e6580054525d3f21f86edfc9f30b7a75ffa829a1eb67ee3cab33f0040dba4e
SHA512

c1926d59272df0e049467f4497bcc3631bbc1aa5337e87f4af31bfdba60c9ef460e394380024ffa7e71fef8938761d48d75e9dc93dc7529d2b9c8c638dddae92
SSDEEP

196608:/dAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:naWedh+Idx75QYub//73lc6u7bLMYxD

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4848	takeown.exe
3916	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4848	takeown.exe
3916	icacls.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\executables.bin	Bonzify.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2584	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2320	1256	Bonzify.exe	91
PID 1256 wrote to memory of 2320	1256	Bonzify.exe	91
PID 1256 wrote to memory of 2320	1256	Bonzify.exe	91
PID 2320 wrote to memory of 2584	2320	cmd.exe	93
PID 2320 wrote to memory of 2584	2320	cmd.exe	93
PID 2320 wrote to memory of 2584	2320	cmd.exe	93
PID 2320 wrote to memory of 4848	2320	cmd.exe	95
PID 2320 wrote to memory of 4848	2320	cmd.exe	95
PID 2320 wrote to memory of 4848	2320	cmd.exe	95
PID 2320 wrote to memory of 3916	2320	cmd.exe	96
PID 2320 wrote to memory of 3916	2320	cmd.exe	96
PID 2320 wrote to memory of 3916	2320	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AgentSvr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\SysWOW64\takeown.exe
    takeown /r /d y /f C:\Windows\MsAgent
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4848
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KillAgent.bat

Filesize
161B

MD5
ea7df060b402326b4305241f21f39736

SHA1
7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

SHA256
e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

SHA512
3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

Download Submit