79dc113a4194e48e01b39d39156ce6b3bd50e02a5b07c1e1f40dd6c4b4cea967

General

Target

Bolbi.vbs
Size

46KB
MD5

99ec3237394257cb0b5c24affe458f48
SHA1

5300e68423da9712280e601b51622c4b567a23a4
SHA256

ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51
SHA512

af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb

Score

10^/10

discovery evasion exploit persistence ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

5 1248 wscript.exe
7 1248 wscript.exe
8 1248 wscript.exe
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

1740 takeown.exe
1788 icacls.exe
788 takeown.exe
1952 icacls.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

1740 takeown.exe
1788 icacls.exe
788 takeown.exe
1952 icacls.exe

flow	pid	process
5	1248	wscript.exe
7	1248	wscript.exe
8	1248	wscript.exe

pid	process
1740	takeown.exe
1788	icacls.exe
788	takeown.exe
1952	icacls.exe

pid	process
1740	takeown.exe
1788	icacls.exe
788	takeown.exe
1952	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Bolbi.vbs"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Bolbi.vbs"	wscript.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

wscript.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\ghostroot\\8ydfdsE.jpg"	wscript.exe

Drops file in Windows directory 1 IoCs

Processes:

wscript.exe

description ioc process

File opened for modification C:\Windows\System32 wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

548 taskkill.exe

description	ioc	process
File opened for modification	C:\Windows\System32	wscript.exe

pid	process
548	taskkill.exe

Modifies Control Panel 4 IoCs

evasion

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\s1159 = "Bolbi"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\International\s2359 = "Bolbi"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Control Panel\Desktop	wscript.exe

Modifies registry class 11 IoCs

Processes:

cmd.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pif\ = "dllfile"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.scr\ = "dllfile"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pif	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.scr	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ = "exefile"	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1472 explorer.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

taskkill.exeexplorer.exetakeown.exeAUDIODG.EXEtakeown.exe

description	pid	process
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeTakeOwnershipPrivilege	1740	takeown.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE
Token: 33	1612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1612	AUDIODG.EXE
Token: SeTakeOwnershipPrivilege	788	takeown.exe
Token: SeShutdownPrivilege	1472	explorer.exe
Token: SeShutdownPrivilege	1472	explorer.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

explorer.exe

pid	process
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

explorer.exe

pid	process
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe
1472	explorer.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

WScript.exewscript.execmd.exe

description	pid	process	target process
PID 1556 wrote to memory of 1248	1556	WScript.exe	wscript.exe
PID 1556 wrote to memory of 1248	1556	WScript.exe	wscript.exe
PID 1556 wrote to memory of 1248	1556	WScript.exe	wscript.exe
PID 1248 wrote to memory of 1520	1248	wscript.exe	cmd.exe
PID 1248 wrote to memory of 1520	1248	wscript.exe	cmd.exe
PID 1248 wrote to memory of 1520	1248	wscript.exe	cmd.exe
PID 1520 wrote to memory of 1516	1520	cmd.exe	rundll32.exe
PID 1520 wrote to memory of 1516	1520	cmd.exe	rundll32.exe
PID 1520 wrote to memory of 1516	1520	cmd.exe	rundll32.exe
PID 1520 wrote to memory of 1172	1520	cmd.exe	reg.exe
PID 1520 wrote to memory of 1172	1520	cmd.exe	reg.exe
PID 1520 wrote to memory of 1172	1520	cmd.exe	reg.exe
PID 1520 wrote to memory of 516	1520	cmd.exe	reg.exe
PID 1520 wrote to memory of 516	1520	cmd.exe	reg.exe
PID 1520 wrote to memory of 516	1520	cmd.exe	reg.exe
PID 1520 wrote to memory of 548	1520	cmd.exe	taskkill.exe
PID 1520 wrote to memory of 548	1520	cmd.exe	taskkill.exe
PID 1520 wrote to memory of 548	1520	cmd.exe	taskkill.exe
PID 1520 wrote to memory of 1472	1520	cmd.exe	explorer.exe
PID 1520 wrote to memory of 1472	1520	cmd.exe	explorer.exe
PID 1520 wrote to memory of 1472	1520	cmd.exe	explorer.exe
PID 1520 wrote to memory of 1740	1520	cmd.exe	takeown.exe
PID 1520 wrote to memory of 1740	1520	cmd.exe	takeown.exe
PID 1520 wrote to memory of 1740	1520	cmd.exe	takeown.exe
PID 1520 wrote to memory of 1788	1520	cmd.exe	icacls.exe
PID 1520 wrote to memory of 1788	1520	cmd.exe	icacls.exe
PID 1520 wrote to memory of 1788	1520	cmd.exe	icacls.exe
PID 1520 wrote to memory of 788	1520	cmd.exe	takeown.exe
PID 1520 wrote to memory of 788	1520	cmd.exe	takeown.exe
PID 1520 wrote to memory of 788	1520	cmd.exe	takeown.exe
PID 1520 wrote to memory of 1952	1520	cmd.exe	icacls.exe
PID 1520 wrote to memory of 1952	1520	cmd.exe	icacls.exe
PID 1520 wrote to memory of 1952	1520	cmd.exe	icacls.exe

System policy modification 1 TTPs 22 IoCs

evasion

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "ATTENTION!"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoPinnedList = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayItemsDisplay = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms, = "1"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Your PC has been wrecked by Bolbi!"	wscript.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPinningToTaskbar = "1"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bolbi.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Bolbi.vbs" /elevated
2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Ghostroot\KillDora.bat
3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\RUNDLL32.EXE user32.dll, UpdatePerUserSystemParameters
4⤵
PID:1516

C:\Windows\system32\reg.exe
reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal" /f
4⤵
PID:1172

C:\Windows\system32\reg.exe
reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Network" /f
4⤵
PID:516

C:\Windows\system32\taskkill.exe
taskkill /f /im explorer.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\explorer.exe
explorer.exe
4⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1472

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32 /Grant Users:F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1788

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\system32\icacls.exe
icacls C:\Windows\ /Grant Users:F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

5

T1112

File Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\Bolbi.txt
Filesize
29B

MD5
b37ed35ef479e43f406429bc36e68ec4

SHA1
5e3ec88d9d13d136af28dea0d3c2529f5b6e3b82

SHA256
cc2b26f9e750e05cd680ef5721d9269fe4c8d23cabf500a2ff9065b6b4f7e08c

SHA512
d1c1ea6292d8113ce8f02a9ad3921e2d8632f036bdfa243bd6600a173ac0b1fc659f91b43c8d9ec0beaabb87d9654f5f231e98fde27e4d9bdfd5862ca5cb13b7

Download Submit
C:\Users\Public\Ghostroot\KillDora.bat
Filesize
482B

MD5
4f08159f1d70d41bf975e23230033a0f

SHA1
ea88d6fbdcf218e0e04a650d947250d8a3dfad40

SHA256
d6e7530e3879225bc21fc17859e5b5c71414375baac27bb361fd9162f4b49e0e

SHA512
958ac467e54d35c4ca5459853d661e49ea81efaa1ce3044114d577fcb757343a40ddb30b9f540cf9c100f05958a843bf312fa879c43bda7513643c824b318d6a

Download Submit
memory/516-61-0x0000000000000000-mapping.dmp

Download
memory/548-62-0x0000000000000000-mapping.dmp

Download
memory/788-68-0x0000000000000000-mapping.dmp

Download
memory/1172-60-0x0000000000000000-mapping.dmp

Download
memory/1248-55-0x0000000000000000-mapping.dmp

Download
memory/1472-63-0x0000000000000000-mapping.dmp

Download
memory/1516-59-0x0000000000000000-mapping.dmp

Download
memory/1520-57-0x0000000000000000-mapping.dmp

Download
memory/1556-54-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Filesize
8KB

Download
memory/1740-64-0x0000000000000000-mapping.dmp

Download
memory/1788-66-0x0000000000000000-mapping.dmp

Download
memory/1952-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads