Overview

overview

8

Static

static

3

Bonzify.exe

windows10-2004-x64

8

Bonzify.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    76s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 20:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bonzify.exe
  • Size 6.4MB
  • Sample260819-y2k3vsvybz
  • SHA256 66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionexploitpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 16 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 56 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bonzify.exe
    "C:\Users\Admin\AppData\Local\Temp\Bonzify.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im AgentSvr.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3452
      • C:\Windows\SysWOW64\takeown.exe
        takeown /r /d y /f C:\Windows\MsAgent
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:4868
      • C:\Windows\SysWOW64\icacls.exe
        icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2244
    • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
      INSTALLER.exe /q
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3752
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5472
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:1996
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4728
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4640
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3544
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5192
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4328
      • C:\Windows\msagent\AgentSvr.exe
        "C:\Windows\msagent\AgentSvr.exe" /regserver
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:4300
      • C:\Windows\SysWOW64\grpconv.exe
        grpconv.exe -o
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2248
    • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
      INSTALLER.exe /q
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3080
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1804
      • C:\Windows\SysWOW64\grpconv.exe
        grpconv.exe -o
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3904
  • C:\Windows\msagent\AgentSvr.exe
    C:\Windows\msagent\AgentSvr.exe -Embedding
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4596
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x0000000000000504
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3248
  • C:\Windows\system32\userinit.exe
    C:\Windows\system32\userinit.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4884
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3420
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:6068
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:256

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          AppInit DLLs

          1
          T1546.010

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          AppInit DLLs

          1
          T1546.010

          Defense Evasion

          File and Directory Permissions Modification

          1
          T1222

          Modify Registry

          3
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          4
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          prep_Activatable Class_Hermes_perf.cache
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
          • Size 599B
          • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          INSTALLER.exe
          • Path C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
          • Size 391KB
          • SHA256 16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INSTALLER.exe
          • Path C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
          • Size 997KB
          • SHA256 709936902951fb684d0a03a561fb7fd41c5e6f81ecd60d326809db66eb659331
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ADVPACK.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
          • Size 73KB
          • SHA256 7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTANM.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
          • Size 40KB
          • SHA256 905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTCTL.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
          • Size 160KB
          • SHA256 d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTDP2.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
          • Size 60KB
          • SHA256 c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTDPV.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
          • Size 64KB
          • SHA256 394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTMPX.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
          • Size 60KB
          • SHA256 6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTPSH.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
          • Size 36KB
          • SHA256 8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTSR.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
          • Size 60KB
          • SHA256 e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGENTSVR.EXE
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
          • Size 268KB
          • SHA256 e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGT0409.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
          • Size 28KB
          • SHA256 6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGT0409.HLP
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
          • Size 8KB
          • SHA256 e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGT20.INF
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
          • Size 2KB
          • SHA256 49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AGTCTL15.TLB
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
          • Size 28KB
          • SHA256 3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AGTINST.INF
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
          • Size 7KB
          • SHA256 bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSLWVTTS.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
          • Size 52KB
          • SHA256 ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Msvcirt.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
          • Size 76KB
          • SHA256 647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Msvcp50.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
          • Size 552KB
          • SHA256 91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          W95INF16.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
          • Size 2KB
          • SHA256 337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          W95INF32.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
          • Size 4KB
          • SHA256 e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          andmoipa.ttf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
          • Size 29KB
          • SHA256 38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
          • Size 1.2MB
          • SHA256 e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.hlp
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
          • Size 11KB
          • SHA256 382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tv_enua.inf
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
          • Size 2KB
          • SHA256 85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tvenuax.dll
          • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
          • Size 40KB
          • SHA256 c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          KillAgent.bat
          • Path C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
          • Size 161B
          • SHA256 e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Bonzi.acs
          • Path C:\Windows\msagent\chars\Bonzi.acs
          • Size 5.0MB
          • SHA256 f3d4425238b5f68b4d41ed5be271d2f4118a245baf808a62dc1a9e6e619b2f95
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3420-457-0x0000023C33AD0000-0x0000023C33D8C000-memory.dmp
          Download

          memory/4884-456-0x000000000E8E0000-0x000000000E8ED000-memory.dmp
          Download

          memory/6068-303-0x0000027E82E90000-0x0000027E82F90000-memory.dmp
          Download

          memory/6068-308-0x0000027E82C90000-0x0000027E82CB0000-memory.dmp
          Download

          memory/6068-288-0x0000027E801E0000-0x0000027E802E0000-memory.dmp
          Download

          memory/6068-287-0x0000027E801E0000-0x0000027E802E0000-memory.dmp
          Download

          memory/6068-286-0x0000027E801E0000-0x0000027E802E0000-memory.dmp
          Download

          memory/6068-342-0x0000027E94190000-0x0000027E941B0000-memory.dmp
          Download

          memory/6068-302-0x0000027E82A30000-0x0000027E82A50000-memory.dmp
          Download