Overview
overview
10Static
static
3windows-ma...00.exe
windows10-1703-x64
windows-ma...32.exe
windows10-1703-x64
3windows-ma...fy.exe
windows10-1703-x64
8Bonzify.exe
windows10-1703-x64
windows-ma...or.exe
windows10-1703-x64
windows-ma...XT.vbs
windows10-1703-x64
1windows-ma...ck.bat
windows10-1703-x64
7windows-ma...ck.exe
windows10-1703-x64
7windows-ma....0.exe
windows10-1703-x64
7windows-ma....0.exe
windows10-1703-x64
10windows-ma...ll.exe
windows10-1703-x64
1windows-ma...p).exe
windows10-1703-x64
10Analysis
-
max time kernel
1800s -
max time network
1609s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-04-2024 20:48
Static task
static1
Behavioral task
behavioral1
Sample
windows-malware-master/000/000.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
windows-malware-master/BonziBuddy/BonziBuddy432.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
windows-malware-master/Bonzify/Bonzify.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Bonzify.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
windows-malware-master/BossDaMajor/BossDaMajor.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
windows-malware-master/ILOVEYOU/LOVE-LETTER-FOR-YOU.TXT.vbs
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
windows-malware-master/MEMZ/Geometry dash auto speedhack.bat
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
windows-malware-master/MEMZ/geometry dash auto speedhack.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
windows-malware-master/MrsMajor 2.0/MrsMajor2.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
windows-malware-master/MrsMajor 3.0/MrsMajor3.0.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
windows-malware-master/SpySheriff/Install.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
Resource
win10-20240404-en
General
-
Target
windows-malware-master/WinXP Horror Edition/WinXP.Horror.Destructive (Created By WobbyChip).exe
-
Size
57.9MB
-
MD5
063ea883f8c67d3bb22e0a465136ca4c
-
SHA1
3a168a9153ee32b86d9a5411b0af13846c55ee1d
-
SHA256
3b64ce283febf3207dd20c99fc53de65b07044231eb544c4c41de374a2571c5c
-
SHA512
2dd6be23a5af8c458b94eeb5a4e83fc8cacb3fd2c2566b5682eee286c01726dca90db3d9b4e218eeded9b0c9bce8ba3c9ca9cc497e3a57aab580633a038e4b74
-
SSDEEP
1572864:aj6L5PLk/mBCSyKOYl39GFoFEujFMm+B997DaNHN1oS72fnD9hRzZ01tO0DpvrvI:i6cSzV9GCFEujFMm+B997DaNHN1oS72X
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Disables Task Manager via registry modification
-
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process File opened for modification \??\PhysicalDrive0 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Modifies Control Panel 2 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Mouse WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (str) \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Mouse\SwapMouseButtons = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exepid process 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe 3568 WinXP.Horror.Destructive (Created By WobbyChip).exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 5084 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5084 AUDIODG.EXE -
System policy modification 1 TTPs 5 IoCs
Processes:
WinXP.Horror.Destructive (Created By WobbyChip).exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WinXP.Horror.Destructive (Created By WobbyChip).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" WinXP.Horror.Destructive (Created By WobbyChip).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows-malware-master\WinXP Horror Edition\WinXP.Horror.Destructive (Created By WobbyChip).exe"C:\Users\Admin\AppData\Local\Temp\windows-malware-master\WinXP Horror Edition\WinXP.Horror.Destructive (Created By WobbyChip).exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3ec1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3568-0-0x0000000003F80000-0x0000000003F81000-memory.dmpFilesize
4KB
-
memory/3568-3-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/3568-4-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/3568-5-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/3568-10-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/3568-12-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB
-
memory/3568-49-0x0000000000400000-0x0000000003DF3000-memory.dmpFilesize
57.9MB