f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5 | Triage

Sharing

General

Target

BaldiTrojan-x64.exe
Size

4.2MB
Sample

240902-l7rrdaxgkq
MD5

e2c4c4dd8c6a357eca164955a8fe040c
SHA1

f4114815bce62efbc78c79f9a83ccf74a4ea075c
SHA256

f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5
SHA512

389bf398f9f9f6ae7e6dfca835f5877befa4ebfee5938d4b50728d77fb0450b2eb2cb67e3f4d9abaaad77231754968b27c69a510448dfd7f52c63b1ce3a1c3e1
SSDEEP

98304:3c9jNgez/S9bL+M0QVtYD0JCqfZlVcc9uNSwfrNaSQHbfU0qC:s95zk0mtyTqj6W4SGYSQ/qC

Score

10^/10

discovery evasion persistence ransomware trojan

Malware Config

Targets

- Target
  
  BaldiTrojan-x64.exe
- Size
  
  4.2MB
- MD5
  
  e2c4c4dd8c6a357eca164955a8fe040c
- SHA1
  
  f4114815bce62efbc78c79f9a83ccf74a4ea075c
- SHA256
  
  f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5
- SHA512
  
  389bf398f9f9f6ae7e6dfca835f5877befa4ebfee5938d4b50728d77fb0450b2eb2cb67e3f4d9abaaad77231754968b27c69a510448dfd7f52c63b1ce3a1c3e1
- SSDEEP
  
  98304:3c9jNgez/S9bL+M0QVtYD0JCqfZlVcc9uNSwfrNaSQHbfU0qC:s95zk0mtyTqj6W4SGYSQ/qC
Score

10^/10

discovery evasion persistence ransomware trojan
- UAC bypass
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceransomwaretrojan