Overview

overview

10

Static

static

1

malware.vbs

windows7-x64

1

malware.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    malware.txt
  • Size 7KB
  • Sample240519-vm34caha5v
  • SHA256 638565ad01412f15dd5782af2fe1e685d91577ddd995e5eabf46916ed7a25cb9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoveryevasionexecutionexploitpersistenceransomwaretrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://bonzi.link/Bon.zip

Targets

    • Target
      malware.txt
    • Size 7KB
    • SHA256 638565ad01412f15dd5782af2fe1e685d91577ddd995e5eabf46916ed7a25cb9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionexecutionexploitpersistenceransomwaretrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

1
T1222

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks