Overview

overview

9

Static

static

new bomani.exe

windows7_x64

9

new bomani.exe

windows10-2004_x64

9

Resubmissions

30/03/2022, 09:01

220330-ky7kssbab7 9

Analysis

  • max time kernel
    138s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    30/03/2022, 09:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    new bomani.exe

  • Size

    78KB

  • MD5

    1a75e7dd18a7186ca44fcf27eb94c4aa

  • SHA1

    049917bb6e78a990f753119e36015c540d51d28f

  • SHA256

    bbad11dfe76b92735648bce03bc5e163e235120d1114391be78665f8c2f14c94

  • SHA512

    8fc7ec6637279dab404cba57c913bfa095de487b2217e7aab9d8653644649e5a2c50882f9ee825f4b0403b45257114d6e6e65e6f2f2e947aa7e00b762ebaa258

Score
9/10
persistenceransomware

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\new bomani.exe
    "C:\Users\Admin\AppData\Local\Temp\new bomani.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2992
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" cd %userprofile%\documents\ attrib Default.rdp -s -h del Default.rdp for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Windows\system32\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Interacts with shadow copies
        PID:2392
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\new bomani.exe > nul
      2⤵
        PID:3968
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1176

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads