Overview

overview

8

Static

static

3

BonziBuddy432.exe

windows10-2004-x64

8

Resubmissions

10-10-2024 14:27

241010-rsdh4awajp 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bon.zip

  • Size

    49.8MB

  • Sample

    241010-rsdh4awajp

  • MD5

    65259c11e1ff8d040f9ec58524a47f02

  • SHA1

    2d5a24f7cadd10140dd6d3dd0dc6d0f02c2d40fd

  • SHA256

    755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42

  • SHA512

    37096eeb1ab0e11466c084a9ce78057e250f856b919cb9ef3920dad29b2bb2292daabbee15c64dc7bc2a48dd930a52a2fb9294943da2c1c3692863cec2bae03d

  • SSDEEP

    1572864:JrXJmVPHHpgbw+ojykM3VO+4hG1peXyKRL2U:J1m5npwwRvgO3ipVAl

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      BonziBuddy432.exe

    • Size

      49.9MB

    • MD5

      06d87d4c89c76cb1bcb2f5a5fc4097d1

    • SHA1

      657248f78abfa9015b77c431f2fd8797481478fd

    • SHA256

      f1e859d99072e35f20e172d8458e3ea1baf8ba86c8c9e311a0debcd2acd5d0fc

    • SHA512

      12bcc681544bfc0cb5f1a3c2e5e3d475efdf5abb8bf0e18cb18f529a82d551f39e16de2d3f0664c2c2cbfab2bc4702e256b958acadca53424e6d8760b6f457f9

    • SSDEEP

      1572864:HVGKQzdb8P3XxxOtGpBXFqRDjSghMDDqRDAtzq9:HVcdeXzOoP1OjfgDOo2

    Score
    8/10
    discoverypersistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks