Resubmissions

16-03-2024 17:14

240316-vsg33ahc39 7

16-03-2024 17:12

240316-vqyb9shb94 10

16-03-2024 15:47

240316-s8g2wsea5y 10

Analysis

  • max time kernel
    127s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 15:47

General

  • Target

    Bolbi.vbs

  • Size

    46KB

  • MD5

    99ec3237394257cb0b5c24affe458f48

  • SHA1

    5300e68423da9712280e601b51622c4b567a23a4

  • SHA256

    ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51

  • SHA512

    af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb

  • SSDEEP

    384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraB:m7BGV95hIG1/d49gsCDsl

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Disables cmd.exe use via registry modification 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
  • Possible privilege escalation attempt 4 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies Control Panel 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • System policy modification 1 TTPs 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bolbi.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Bolbi.vbs" /elevated
      2⤵
      • UAC bypass
      • Blocklisted process makes network request
      • Disables cmd.exe use via registry modification
      • Sets file execution options in registry
      • Checks computer location settings
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4576
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Ghostroot\KillDora.bat
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\RUNDLL32.EXE user32.dll, UpdatePerUserSystemParameters
          4⤵
            PID:1540
          • C:\Windows\system32\reg.exe
            reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal" /f
            4⤵
              PID:236
            • C:\Windows\system32\reg.exe
              reg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Network" /f
              4⤵
                PID:3060
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im explorer.exe
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2344
              • C:\Windows\explorer.exe
                explorer.exe
                4⤵
                • Modifies Installed Components in the registry
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2496
              • C:\Windows\system32\takeown.exe
                takeown /f C:\Windows\System32\
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:4816
              • C:\Windows\system32\icacls.exe
                icacls C:\Windows\System32 /Grant Users:F
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:1108
              • C:\Windows\system32\takeown.exe
                takeown /f C:\Windows\
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:3052
              • C:\Windows\system32\icacls.exe
                icacls C:\Windows\ /Grant Users:F
                4⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:4900
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Bolbi.txt
          1⤵
          • Opens file in notepad (likely ransom note)
          PID:1716
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4876
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4016
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:4944
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3332
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3860
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2204
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of SendNotifyMessage
          PID:4180
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3060
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5068
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:4528
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:1800
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3752
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          PID:3752
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2508
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4920
        • C:\Windows\system32\wscript.exe
          wscript.exe C:\Users\Public\ghostroot\Message.vbs explorer.exe
          1⤵
            PID:5540
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3864

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

              Filesize

              471B

              MD5

              15ba8922cc5141a3c592c521ddc5d8b7

              SHA1

              227753f21d6feab9879b601c103ba6f793869d92

              SHA256

              bab865b29c5aafc2d0ad457e59a96ec8726781126260bc36c533e53e4913fd33

              SHA512

              60696d5ba30f2750ca90161019d9474701e3b9c3d773d060ad6f499a87d2e88679ea620a672b10cb9dca35daf791b2ebea975a04c2271530d3574a9f2eaeeb7c

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53

              Filesize

              412B

              MD5

              87d754bdcbec31a183d1c89302ab6ab7

              SHA1

              6f3745e0b61c93bace1611440ce62ba943721cdd

              SHA256

              ff51be7fc87472f76ead5bed9aa20dff70c4b96d1be656c3591c620b8a62a8af

              SHA512

              28ea610bd8141cd4ee520a5929db0d7c0a52f88b9a04a18a18a1d5bc83827ac4ac3bb96cd4be4dbeadf5833ad485487bd7d03ebaf3a24c348472fcecf9941e42

            • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1SA07OI6\microsoft.windows[1].xml

              Filesize

              97B

              MD5

              fb9854a5b056cc3d006b38bf0eab1b7c

              SHA1

              0a2b0432e2e9938be1f652c2247827e47b265f44

              SHA256

              3d454d15255bb82fb8a4cfa40ea848af32395be899aaaf83b6d626a814aa21c2

              SHA512

              20366182bf5a658b19e3df4eef2fa4e484bdcecc85a893834fbcb2b0ab64100a7694c3dbbdf1597bf3e3a747ede6fe7b81aab5f07653ef40a515edbef90ed00d

            • C:\Users\Admin\Desktop\Bolbi.txt

              Filesize

              29B

              MD5

              b37ed35ef479e43f406429bc36e68ec4

              SHA1

              5e3ec88d9d13d136af28dea0d3c2529f5b6e3b82

              SHA256

              cc2b26f9e750e05cd680ef5721d9269fe4c8d23cabf500a2ff9065b6b4f7e08c

              SHA512

              d1c1ea6292d8113ce8f02a9ad3921e2d8632f036bdfa243bd6600a173ac0b1fc659f91b43c8d9ec0beaabb87d9654f5f231e98fde27e4d9bdfd5862ca5cb13b7

            • C:\Users\Admin\Music\Slap1.vbs

              Filesize

              46KB

              MD5

              99ec3237394257cb0b5c24affe458f48

              SHA1

              5300e68423da9712280e601b51622c4b567a23a4

              SHA256

              ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51

              SHA512

              af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb

            • C:\Users\Public\Ghostroot\KillDora.bat

              Filesize

              482B

              MD5

              4f08159f1d70d41bf975e23230033a0f

              SHA1

              ea88d6fbdcf218e0e04a650d947250d8a3dfad40

              SHA256

              d6e7530e3879225bc21fc17859e5b5c71414375baac27bb361fd9162f4b49e0e

              SHA512

              958ac467e54d35c4ca5459853d661e49ea81efaa1ce3044114d577fcb757343a40ddb30b9f540cf9c100f05958a843bf312fa879c43bda7513643c824b318d6a

            • C:\Users\Public\ghostroot\Message.vbs

              Filesize

              55B

              MD5

              302e08c86880a39ca55f21cabfa7c5de

              SHA1

              58d56c0eb14fc0401cda7c48d6df9d23f6e9b7e3

              SHA256

              65cfb12baaa6f5891bcd7fda727933a4a12f6dbfa9a6717549eacc6dee9436c7

              SHA512

              9aac68a57cea3d00b956ff82ce443600a969dbc3e4eb2b7b12902f70e318c7dbbf7378b375dd28c0d3be0a0515c5c69d4dd5610d5778f22c4e33765d704f8ff7

            • C:\Users\Public\ghostroot\rpdbfk.exe

              Filesize

              16KB

              MD5

              c00be65597bf40636145c34fbf4788c0

              SHA1

              6809a72fc75f323137e43c91cc0465328cbb525d

              SHA256

              8861afb9340e88a7f139fe1022748db3658b31ff505de897569032a1b34ed5ea

              SHA512

              1d948c49c94daf764ed8cd2b94aa78abc7a23b1fb7a1aa8dffc529cbeeaedb52ee693113a424c75abc80f5dc1a0c69cceb291e3ab47b96811cfd72e2b4494f23

            • memory/2204-33-0x000001C0C9AA0000-0x000001C0C9AC0000-memory.dmp

              Filesize

              128KB

            • memory/2204-35-0x000001C0CA0C0000-0x000001C0CA0E0000-memory.dmp

              Filesize

              128KB

            • memory/2204-31-0x000001C0C9AE0000-0x000001C0C9B00000-memory.dmp

              Filesize

              128KB

            • memory/3332-25-0x00000000047D0000-0x00000000047D1000-memory.dmp

              Filesize

              4KB

            • memory/3752-82-0x0000022187920000-0x0000022187940000-memory.dmp

              Filesize

              128KB

            • memory/3752-84-0x00000221878E0000-0x0000022187900000-memory.dmp

              Filesize

              128KB

            • memory/3752-86-0x0000022187F00000-0x0000022187F20000-memory.dmp

              Filesize

              128KB

            • memory/3752-446-0x0000000004250000-0x0000000004251000-memory.dmp

              Filesize

              4KB

            • memory/4180-44-0x0000000004950000-0x0000000004951000-memory.dmp

              Filesize

              4KB

            • memory/4528-75-0x0000000004C60000-0x0000000004C61000-memory.dmp

              Filesize

              4KB

            • memory/4920-723-0x000002846E940000-0x000002846E960000-memory.dmp

              Filesize

              128KB

            • memory/4920-765-0x000002846EF20000-0x000002846EF40000-memory.dmp

              Filesize

              128KB

            • memory/4920-753-0x000002846E900000-0x000002846E920000-memory.dmp

              Filesize

              128KB

            • memory/5068-55-0x0000025CDD820000-0x0000025CDD840000-memory.dmp

              Filesize

              128KB

            • memory/5068-53-0x0000025CDD420000-0x0000025CDD440000-memory.dmp

              Filesize

              128KB

            • memory/5068-51-0x0000025CDD460000-0x0000025CDD480000-memory.dmp

              Filesize

              128KB