f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5

Reason

Machine shutdown

General

Target
BaldiTrojan-x64.exe
Size 4.2MB
Sample260822-v79fvsfg75
SHA256 f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5
MD5 e2c4c4dd8c6a357eca164955a8fe040c
SHA1 f4114815bce62efbc78c79f9a83ccf74a4ea075c
SHA512 389bf398f9f9f6ae7e6dfca835f5877befa4ebfee5938d4b50728d77fb0450b2eb2cb67e3f4d9abaaad77231754968b27c69a510448dfd7f52c63b1ce3a1c3e1
SSDEEP 98304:3c9jNgez/S9bL+M0QVtYD0JCqfZlVcc9uNSwfrNaSQHbfU0qC:s95zk0mtyTqj6W4SGYSQ/qC
TLSH
T1A326338694B17BDBFA050133A1793EA9796BFCE7D54A040A14DEB4E13DF3983026BC91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Baldi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Baldi.exe

Executes dropped EXE 3 IoCs

pid	Process
3536	Baldi.exe
644	DisableUAC.exe
4556	Baldi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GG.exe = "C:\\Baldi\\Baldi.exe"	Baldi.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\Desktop\Wallpaper = "C:\\Baldi\\lol.png"	Baldi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5340	cmd.exe
3016	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BaldiTrojan-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baldi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baldi.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5980	taskkill.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\desktop	Baldi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\Desktop\TileWallpaper = "0"	Baldi.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "7"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	468	shutdown.exe
Token: SeRemoteShutdownPrivilege	468	shutdown.exe
Token: SeDebugPrivilege	5980	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
628	LogonUI.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 5340	1072	BaldiTrojan-x64.exe	87
PID 5340 wrote to memory of 3536	5340	cmd.exe	89
PID 5340 wrote to memory of 644	5340	cmd.exe	90
PID 644 wrote to memory of 3016	644	DisableUAC.exe	93
PID 3016 wrote to memory of 2180	3016	cmd.exe	94
PID 3016 wrote to memory of 468	3016	cmd.exe	95
PID 3536 wrote to memory of 5980	3536	Baldi.exe	97

C:\Users\Admin\AppData\Local\Temp\BaldiTrojan-x64.exe
"C:\Users\Admin\AppData\Local\Temp\BaldiTrojan-x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CleanZUpdater.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Baldi\Baldi.exe
    C:\Baldi\Baldi.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\Baldi\DisableUAC.exe
    C:\Baldi\DisableUAC.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8A2A.tmp\8A2B.bat C:\Baldi\DisableUAC.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Windows\system32\reg.exe
        
        reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:2180
    - - C:\Windows\system32\shutdown.exe
        
        shutdown -r -t 1 -c "BALDI EVIL..."
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:468

C:\Baldi\Baldi.exe
C:\Baldi\Baldi.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4556

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3929055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

Baldi.exe

Path C:\Baldi\Baldi.exe
Size 12.4MB
SHA256 fd27fb8b14a5fa99bba87560510030a5ab9df47e4f7584cb4d0e31c04e11808b
MD5 515bc425daa9558e4a12a917e7dfc701
SHA1 bef7a2a3f78189922be2b1f59b9e2636c6a8156e
SHA512 41b2b95aea7ed7bc039f64146581ba695af8a441cfb7cba989d2204fe47f8de974334c224a085f30fbc3fc51455986a73c3bdb90952f1e7bc9b6c8074432dbdc
SSDEEP 98304:4PyiUHCa1abtUvA5b1PSqhRLuaY673+/4ByCNlFSB+sgpDhsfC2PDORalZLCwpo3:ww2U4tuWbDa9PY
TLSH
T159D6E722F2609F35C0DE5739549F4B614331411B8B93A78702E499BDFD892A22FBA74F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CleanZUpdater.bat

Path C:\Baldi\CleanZUpdater.bat
Size 66B
SHA256 2683d451ab3423e25bcbeca902e6b586d0d9e8689c9c1bb6dca47bfae547a7d7
MD5 b54e64a1f0b58d09cf57d983d7ba7361
SHA1 d6c36454390be4eea41512bd39a9c68d77f614bf
SHA512 583a6b07d584a433a78c8a948807caf5d1bfa0a1b8ef6dcf5a7f67db38e03baf875cabdc91f974276295c01485b78c11002b4cf10f08346ab92c2375479beb0a
TLSH
T1F8A00202AF911D03C40156C4C2F96F42E70B08498A1396B0028940A5C79F0C5F5AC445
MD5 SHA1 SHA512 TLSH

Submit Download

DisableUAC.exe

Path C:\Baldi\DisableUAC.exe
Size 104KB
SHA256 f5add589da4bfb1492531306d12e84ef27bfcb0c31ff51fed710215765ac95f4
MD5 9ad923e0b582d7520dbd655c36c1cdd5
SHA1 189c9b2c40f0a84af365e0bb8b88e97243560cc3
SHA512 ea73a7e5262fd148bc8b5d7d5a7c20a1c6683defb7c2ea48cdc22595420307b18ca20ecaf1135ad24131d2ab6ce1346e3abf78abed0e2728878c0f993509fb0c
SSDEEP 1536:lD5s9u/O4wppE7b6Ca9wOxibBjPm8YEZDVAguwWx4c6fFSq35t:3s9uWfE7mt+BzXYEZDVAgVWuc69Sq35t
TLSH
T169A33A67329411C8DBE742B5CA61174BE7B034761B20A3CF1BA4879A2F2B8D49F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8A2B.bat

Path C:\Users\Admin\AppData\Local\Temp\8A2A.tmp\8A2B.bat
Size 186B
SHA256 754d5b111ec7225c4d643142ddf0dfaab585f12b2f69bcca088abbd0d23a5a79
MD5 a708b066fda65f8d7f94a2cbd4919b0f
SHA1 5c723e4f1ba46b5cb6813b5db490dd63748cb07c
SHA512 75b7a6401ebfb2aa9194ff3ef48f8c23044342ddb2f2b9b33020b6ec7592dd2a1b0546ef7387641fb17cccd7f726fe665386c471f01b4e715d7e9b713baa1bc5
TLSH
T110C0221186200026A761A102A4C68C82BB7A82471482E38120998016A2628C6813C1DF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3536-13-0x00000000013D0000-0x00000000013D1000-memory.dmp

Download

memory/3536-18-0x0000000000400000-0x0000000001080000-memory.dmp

Download

memory/4556-19-0x0000000000400000-0x0000000001080000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads