28216f94328e942434bc24d7af60ce691f46f2ac5f1381d6ac093d32e65489a5

Resubmissions

16-03-2024 17:14

240316-vsg33ahc39 7

16-03-2024 17:12

240316-vqyb9shb94 10

16-03-2024 15:47

240316-s8g2wsea5y 10

Analysis

max time kernel
121s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Windows/Bonzify.exe
Size

6.4MB
MD5

9c352d2ce0c0bdc40c72f52ce3480577
SHA1

bd4c956186f33c92eb4469f7e5675510d0790e99
SHA256

d7e6580054525d3f21f86edfc9f30b7a75ffa829a1eb67ee3cab33f0040dba4e
SHA512

c1926d59272df0e049467f4497bcc3631bbc1aa5337e87f4af31bfdba60c9ef460e394380024ffa7e71fef8938761d48d75e9dc93dc7529d2b9c8c638dddae92
SSDEEP

196608:/dAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:naWedh+Idx75QYub//73lc6u7bLMYxD

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1692	takeown.exe
3020	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3020	icacls.exe
1692	takeown.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\executables.bin	Bonzify.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1320	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2156	3868	Bonzify.exe	88
PID 3868 wrote to memory of 2156	3868	Bonzify.exe	88
PID 3868 wrote to memory of 2156	3868	Bonzify.exe	88
PID 2156 wrote to memory of 1320	2156	cmd.exe	91
PID 2156 wrote to memory of 1320	2156	cmd.exe	91
PID 2156 wrote to memory of 1320	2156	cmd.exe	91
PID 2156 wrote to memory of 1692	2156	cmd.exe	94
PID 2156 wrote to memory of 1692	2156	cmd.exe	94
PID 2156 wrote to memory of 1692	2156	cmd.exe	94
PID 2156 wrote to memory of 3020	2156	cmd.exe	95
PID 2156 wrote to memory of 3020	2156	cmd.exe	95
PID 2156 wrote to memory of 3020	2156	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe
"C:\Users\Admin\AppData\Local\Temp\Windows\Bonzify.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im AgentSvr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1320
- - C:\Windows\SysWOW64\takeown.exe
    takeown /r /d y /f C:\Windows\MsAgent
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1692
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KillAgent.bat

Filesize
161B

MD5
ea7df060b402326b4305241f21f39736

SHA1
7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

SHA256
e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

SHA512
3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

Download Submit