638565ad01412f15dd5782af2fe1e685d91577ddd995e5eabf46916ed7a25cb9 | Triage

Sharing

General

Target

malware.txt
Size

7KB
Sample

240519-vm34caha5v
MD5

775f152b958147204f3cc3a4da63c6c8
SHA1

4814e610f5322f3a9a197c8fd2be170946732367
SHA256

638565ad01412f15dd5782af2fe1e685d91577ddd995e5eabf46916ed7a25cb9
SHA512

1bcaa377cabf089f072c8adca62a137ad5ca14ab71ddf3dda7c852ad4a841d5f1678128a0e3c2312d685af8edc5e5ea6189cba0282d93edee9fa1cdf519adc3c
SSDEEP

96:qD2WSNb8mN8r9f4PPfMSHnx2gqoAqb1j8RW8E/zmdPzWdEKuWP2W9Nukim26195F:qD8qrZgX7xrCdPidfbj2619z

Score

10^/10

discovery evasion execution exploit persistence ransomware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://bonzi.link/Bon.zip

Targets

- Target
  
  malware.txt
- Size
  
  7KB
- MD5
  
  775f152b958147204f3cc3a4da63c6c8
- SHA1
  
  4814e610f5322f3a9a197c8fd2be170946732367
- SHA256
  
  638565ad01412f15dd5782af2fe1e685d91577ddd995e5eabf46916ed7a25cb9
- SHA512
  
  1bcaa377cabf089f072c8adca62a137ad5ca14ab71ddf3dda7c852ad4a841d5f1678128a0e3c2312d685af8edc5e5ea6189cba0282d93edee9fa1cdf519adc3c
- SSDEEP
  
  96:qD2WSNb8mN8r9f4PPfMSHnx2gqoAqb1j8RW8E/zmdPzWdEKuWP2W9Nukim26195F:qD8qrZgX7xrCdPidfbj2619z
Score

10^/10

discovery evasion execution exploit persistence ransomware trojan
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Creates new service(s)
  persistence execution
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

Service Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Disable or Modify System Firewall

Modify Registry

File and Directory Permissions Modification

Credential Access

Discovery

System Information Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

Resource Development

Reconnaissance

Tasks

static1

behavioral1

behavioral2

discoveryevasionexecutionexploitpersistenceransomwaretrojan