Overview

overview

8

Static

static

1

URLScan

urlscan

http://bonzybuddy.org

windows11-ltsc_2024-x64

Resubmissions

27/06/2026, 17:20

260627-vwhh1abz7t

27/06/2026, 17:14

260627-vr3clscv7p8

Sharing

Copy URL Twitter E-mail

General

  • Target
    http://bonzybuddy.org
  • Sample260627-vr3clscv7p
Score
8/10
defense_evasiondiscoveryexploitpersistenceprivilege_escalationransomware

Malware Config

Targets

    • Target
      http://bonzybuddy.org
    Score
    8/10
    defense_evasiondiscoveryexploitpersistenceprivilege_escalationransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Possible privilege escalation attempt

      exploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Power Settings

1
T1653

Privilege Escalation

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Defense Evasion

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Modify Registry

1
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks