ee2a2b418e82683de196beb5d4f6cb213e7579d783b06b9949f4a988f515b324

General

Target

Bolbi.vbs
Size

1.1MB
MD5

584f03161a17b36b2f5163dd85bc0b77
SHA1

04dad07d0146ff09c0dacc3f248dbda16055a609
SHA256

ee2a2b418e82683de196beb5d4f6cb213e7579d783b06b9949f4a988f515b324
SHA512

530ef231a0fea29700d8bbffa5ed40b4cc05b96323fcbd853e86f050362d84f8a5250387f86a47ec0f103a76b00bada9c352a3c6c76736740984732c184003ff
SSDEEP

24576:gjSdueeKiZeXA940z802o5mNBriKgcdgUixQsUgk:gjSduKCeA2oqdJqfk

Score

6^/10

persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Just For You.jpg.vbs"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Just For You.jpg.vbs"	wscript.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	solitaire.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\ghostroot\\god.bmp"	wscript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 5 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop\OriginalWallpaper = "C:\\Users\\Public\\ghostroot\\god.bmp"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\s1159 = "Bolbi"	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\s2359 = "Bolbi"	wscript.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\Desktop	wscript.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats	solitaire.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}\LastPlayed = "0"	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software	solitaire.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft	solitaire.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
608	NOTEPAD.EXE
1968	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1152	solitaire.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2864	3024	WScript.exe	30
PID 3024 wrote to memory of 2864	3024	WScript.exe	30
PID 3024 wrote to memory of 2864	3024	WScript.exe	30

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "ATTENTION!"	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Your PC has been wrecked by Bolbi!"	wscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bolbi.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Bolbi.vbs" /elevated
  2⤵
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - Drops file in Windows directory
  - Modifies Control Panel
  - System policy modification
  PID:2864
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Public\ghostroot\Player.vbs
    3⤵
    PID:1320
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c C:\Users\Public\Ghostroot\KillDora.bat
    3⤵
    PID:2432
  - - C:\Windows\system32\gpupdate.exe
      gpupdate.exe /force
      4⤵
      PID:2452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:2
1⤵
PID:2492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:2932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:1
1⤵
PID:2404

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2236 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:1
1⤵
PID:944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=2408 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:1
1⤵
PID:240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --mojo-platform-channel-handle=2760 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:1
1⤵
PID:652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:2
1⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --mojo-platform-channel-handle=3480 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:1
1⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3684 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:1644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3848 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:2880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3872 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:1928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3868 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:1108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 --field-trial-handle=1336,i,11993726072816792203,5379939194682326223,131072 /prefetch:8
1⤵
PID:988

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Bolbi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:608

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Bolbi.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1968

C:\Program Files\Microsoft Games\solitaire\solitaire.exe
"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:1152

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
PID:2316

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
0accb3fc627a1ff4a03f76160fd5b132

SHA1
2a667746c2ce38f43a40f86a7a784fdfeef8a930

SHA256
2484931ef1da1ed4862005b71be226226b0650226eaace4be4804aa51c593764

SHA512
564d260223092cae64de02e1970b1e497343605ffad1d130a18efeac25b026ae0b0884c6503ca70ca3b021aa79c971220d760dbc6170cacd1cf48f8d6afc9d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\Desktop\Bolbi.txt

Filesize
29B

MD5
b37ed35ef479e43f406429bc36e68ec4

SHA1
5e3ec88d9d13d136af28dea0d3c2529f5b6e3b82

SHA256
cc2b26f9e750e05cd680ef5721d9269fe4c8d23cabf500a2ff9065b6b4f7e08c

SHA512
d1c1ea6292d8113ce8f02a9ad3921e2d8632f036bdfa243bd6600a173ac0b1fc659f91b43c8d9ec0beaabb87d9654f5f231e98fde27e4d9bdfd5862ca5cb13b7

Download Submit
C:\Users\Public\Ghostroot\KillDora.bat

Filesize
918B

MD5
45fcae4003de1832e478518394c3c0c8

SHA1
47c663c601b426748601e4b81c3bcf6a35c12b06

SHA256
2244d7c88dc24a9630f1845fda5ab0a3677190d9ce9a0493f58c5d976160eb11

SHA512
aa3bab3c6eaa809a55c62e6626edf20e9d8cf97a65e957f4e4d550dc3105a4f28eb3b438fb67cd75105922bd55129f72e2e15355ece892905102dda0050396e9

Download Submit
C:\Users\Public\ghostroot\Player.vbs

Filesize
528B

MD5
b2ca858d3b7c50e46c226c7db3501cfd

SHA1
3410bd8c9e09d694f10bba0051b634009c3f9c2e

SHA256
b64d2e53ebcddb6c36cc5429c5483a01abac40def4a3a027f89104156328d41b

SHA512
0880c6dd1fe3aa3e00f50d0467281142eb229cea5b8f1e1a0203a681cdb40aef80039fc08fcad6e0608bc4277af7aa65cb0cb84fcc9494d1d76d4116a93a22ca

Download Submit
C:\Users\Public\ghostroot\SOUNDS FROM HELL RECORDING TOTALLY LEGIT.mp3

Filesize
501KB

MD5
41c89eebb86e4f4b1b0033d8e0214026

SHA1
2010f7fc5e3086fef00c42d8660e1534bc95177e

SHA256
9dd0d4b5d11a686f9320a306d78b37404a5397e2e0d79628363db348ae9b1c48

SHA512
70d8879dd2b840b014c6301927aa43263b40925d8523bed252dc5719fd9a7228c986edece441b402cc64537ca0583d781e9a88431f88188aecb3973824b9f621

Download Submit
memory/1152-24-0x000007FEF3BC0000-0x000007FEF3CF1000-memory.dmp

Filesize
1.2MB

Download
memory/1152-30-0x000007FEF3BC0000-0x000007FEF3CF1000-memory.dmp

Filesize
1.2MB

Download
memory/1152-29-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1152-26-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/1152-20-0x0000000001C90000-0x0000000001C9A000-memory.dmp

Filesize
40KB

Download
memory/1152-19-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1320-179-0x000007FEF5C90000-0x000007FEF6081000-memory.dmp

Filesize
3.9MB

Download
memory/1320-177-0x000007FEF5C90000-0x000007FEF6081000-memory.dmp

Filesize
3.9MB

Download
memory/1320-178-0x0000000001C00000-0x0000000001C01000-memory.dmp

Filesize
4KB

Download
memory/2316-33-0x0000000073E3D000-0x0000000073E48000-memory.dmp

Filesize
44KB

Download
memory/2316-159-0x0000000073E3D000-0x0000000073E48000-memory.dmp

Filesize
44KB

Download
memory/2316-133-0x000000006E021000-0x000000006E022000-memory.dmp

Filesize
4KB

Download
memory/2316-32-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads