VanGoth.exe

General
Target

VanGoth.exe

Filesize

36KB

Completed

14-10-2021 01:41

Score
8/10
MD5

afff555062c4e6fb3a34e7c2be519fcd

SHA1

73ed552ba04e57e8cd991f9f82a182aa298c4baa

SHA256

d27a5719ec67c146a1b338302074de39f5ad49b17f81cb014cc2c57c4f464d85

Malware Config
Signatures 11

Filter: none

Collection
Credential Access
  • Drops file in Drivers directory
    VanGoth.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\SysWOW64\drivers\gmreadme.txtVanGoth.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Drops file in System32 directory
    VanGoth.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc350u.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf583u.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txtVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4340t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa520t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\koc650X.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj5500t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp8500at.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\en-US\erofflps.txtVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc3100t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd1360t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hphp910t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5400t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpn5150t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpf4400t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc610u.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsMovieMaker.bmpVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2400t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpf4100t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj3500t.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\en-US\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\koc353X.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\sml455u.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\RacRules.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpah470t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4300t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpD5400t.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\oobe\background.bmpVanGoth.exe
    File opened for modificationC:\Windows\System32\catroot2\dberr.txtVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\hpmcpcp6.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2500t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa440t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\kom4650X.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsOutlookExpress.bmpVanGoth.exe
    File createdC:\Windows\SysWOW64\migwiz\PostMigRes\data\HardwareVendors.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\NdfEventView.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj5700t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpd7500t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7600t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp6500nt.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc5100t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc6200t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd1500t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc5500t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5300t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc6300t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp8500nt.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpc4600t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc660u.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc6100t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2360t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd4100t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smx620u.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\icsxml\osinfo.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\tsmxuPipelineConfig.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmpVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5100t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk8600t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp8000at.xmlVanGoth.exe
    File createdC:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5060t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa620t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc5300t.xmlVanGoth.exe
    File createdC:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc4500t.xmlVanGoth.exe
  • Drops file in Program Files directory
    VanGoth.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.pngVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Adobe.cssVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.pngVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmvVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xmlVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.pngVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\30.pngVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.htmlVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.pngVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime.cssVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.pngVanGoth.exe
    File createdC:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xmlVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.pngVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.pngVanGoth.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.pngVanGoth.exe
    File opened for modificationC:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\LogoBeta.pngVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xmlVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.htmlVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xmlVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xmlVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.pngVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.htmlVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.pngVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterToolTemplates.xmlVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.htmlVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\row_over.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\34.pngVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.pngVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.pngVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xmlVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xmlVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmpVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.htmlVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.pngVanGoth.exe
    File opened for modificationC:\Program Files\UnregisterOptimize.oggVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.htmlVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xmlVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmpVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.pngVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.pngVanGoth.exe
    File createdC:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xmlVanGoth.exe
    File opened for modificationC:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.pngVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert.cssVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl.cssVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Verve.xmlVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpgVanGoth.exe
    File opened for modificationC:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen.cssVanGoth.exe
    File createdC:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_over.pngVanGoth.exe
    File opened for modificationC:\Program Files\7-Zip\Lang\nn.txtVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.pngVanGoth.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.htmlVanGoth.exe
    File opened for modificationC:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.htmlVanGoth.exe
    File createdC:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.pngVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.pngVanGoth.exe
    File createdC:\Program Files\Internet Explorer\Timeline.cpu.xmlVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.pngVanGoth.exe
    File createdC:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.pngVanGoth.exe
    File createdC:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpgVanGoth.exe
  • Drops file in Windows directory
    VanGoth.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\winsxs\amd64_microsoft-windows-s..ndthemes-characters_31bf3856ad364e35_6.1.7600.16385_none_08da32b0fdad9220\Windows Exclamation.wavVanGoth.exe
    File createdC:\Windows\Media\Calligraphy\Windows Print complete.wavVanGoth.exe
    File createdC:\Windows\Media\Sonata\Windows Critical Stop.wavVanGoth.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallPersonalization.sqlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\novelty_m.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\36.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Peacock.jpgVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-huecycle_31bf3856ad364e35_6.1.7600.16385_none_810df6f57d9f2a73\huemainsubpicture2.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_480_5sec_6mbps_h264.mp4VanGoth.exe
    File createdC:\Windows\winsxs\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\WebAdminHelp_Application.aspxVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4d6aa30008b38d10\cpu.htmlVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-t..riventextservice-yi_31bf3856ad364e35_6.1.7600.16385_none_4153c9e11ffae30c\TableTextServiceYi.txtVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-t..tional-chinese-dayi_31bf3856ad364e35_6.1.7600.16385_none_6052679946eea92d\TableTextServiceDaYi.txtVanGoth.exe
    File createdC:\Windows\winsxs\x86_netfx-aspnet_webevent_sqlprov_b03f5f7f11d50a3a_6.1.7600.16385_none_77bb8934c5837c8b\UninstallWebEventSqlProvider.sqlVanGoth.exe
    File createdC:\Windows\Media\Characters\Windows Critical Stop.wavVanGoth.exe
    File createdC:\Windows\Media\Festival\Windows Hardware Fail.wavVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\add_over.pngVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_0dfaaaec65b0831b\bPrev-hot.pngVanGoth.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\security0.aspxVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\modern_dot.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp4.jpgVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile38.bmpVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d158ae10876efd6d\currency.cssVanGoth.exe
    File createdC:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp6.jpgVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\44.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\greenStateIcon.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\MigApp.xmlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\security_watermark.jpgVanGoth.exe
    File createdC:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_debuggers.help.txtVanGoth.exe
    File createdC:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_prompts.help.txtVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\oskmenu.xmlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\7.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\3.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gpupipeline_31bf3856ad364e35_6.1.7601.17514_none_5a5226e685faba67\DissolveNoise.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\GreenBubbles.jpgVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-pets_31bf3856ad364e35_6.1.7600.16385_none_d0d7ee773d711005\Pets_btn-previous-static.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Hydrangeas.jpgVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipssrl.xmlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile27.bmpVanGoth.exe
    File createdC:\Windows\winsxs\amd64_netfx-aspnet_webadmin_help_b03f5f7f11d50a3a_6.1.7600.16385_none_094460616193b3f6\WebAdminHelp_Internals.aspxVanGoth.exe
    File createdC:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_do.help.txtVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Stars.jpgVanGoth.exe
    File createdC:\Windows\Media\Heritage\Windows Exclamation.wavVanGoth.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspxVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\corner.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-pets_31bf3856ad364e35_6.1.7600.16385_none_d0d7ee773d711005\Pets_notes-txt-background.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-cityscape_31bf3856ad364e35_6.1.7600.16385_none_5b48f43248490503\Windows Print complete.wavVanGoth.exe
    File createdC:\Windows\winsxs\amd64_prnhp003.inf_31bf3856ad364e35_6.1.7600.16385_none_2fd781a76c9dcc13\Amd64\hpd5060t.xmlVanGoth.exe
    File createdC:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Quoting_Rules.help.txtVanGoth.exe
    File createdC:\Windows\PLA\Rules\Rules.System.Memory.xmlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-babygirl_31bf3856ad364e35_6.1.7600.16385_none_b2bd01695c9021fd\16_9-frame-highlight.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-vignette_31bf3856ad364e35_6.1.7600.16385_none_cc1304de922cc585\NavigationUp_SelectionSubpicture.pngVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\oskmenubase.xmlVanGoth.exe
    File createdC:\Windows\winsxs\x86_netfx-aspnet_membership_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_41ed62770d4da14e\InstallMembership.sqlVanGoth.exe
    File opened for modificationC:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallMembership.sqlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-editions-client_31bf3856ad364e35_6.1.7600.16385_none_bc037fbe81d7b074\HomePremiumEdition.xmlVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Logon Sound.wavVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\oskpred.xmlVanGoth.exe
    File createdC:\Windows\Media\Landscape\Windows Print complete.wavVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-searchdiagnostic_31bf3856ad364e35_6.1.7600.16385_none_8d9dc2260d0e1a98\SearchDiagnostic.xmlVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2b166002b7f51771\settings.htmlVanGoth.exe
    File createdC:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\settings_box_divider_left.pngVanGoth.exe
    File createdC:\Windows\Media\Delta\Windows Hardware Fail.wavVanGoth.exe
    File createdC:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\logo.pngVanGoth.exe
  • Opens file in notepad (likely ransom note)
    NOTEPAD.EXE

    Tags

    Reported IOCs

    pidprocess
    1488NOTEPAD.EXE
  • Suspicious behavior: EnumeratesProcesses
    taskmgr.exe

    Reported IOCs

    pidprocess
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
  • Suspicious behavior: GetForegroundWindowSpam
    taskmgr.exe

    Reported IOCs

    pidprocess
    1620taskmgr.exe
  • Suspicious use of AdjustPrivilegeToken
    taskmgr.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1620taskmgr.exe
  • Suspicious use of FindShellTrayWindow
    taskmgr.exe

    Reported IOCs

    pidprocess
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
  • Suspicious use of SendNotifyMessage
    taskmgr.exe

    Reported IOCs

    pidprocess
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
    1620taskmgr.exe
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\VanGoth.exe
    "C:\Users\Admin\AppData\Local\Temp\VanGoth.exe"
    Drops file in Drivers directory
    Drops file in System32 directory
    Drops file in Program Files directory
    Drops file in Windows directory
    PID:1800
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    PID:1816
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:1620
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READ_IT.txt
    Opens file in notepad (likely ransom note)
    PID:1488
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\Desktop\READ_IT.txt

                        MD5

                        12afabdd31b93a97f5dd6d9eef522ef5

                        SHA1

                        ea374f1d85a199f015c203f13fef66167590cc91

                        SHA256

                        59063bbd426e986b4fed2eb5352f7c094554c4219d352a2050953d03c7f5bc52

                        SHA512

                        3004df1e68e7abe78f321b21ed83c9a953958ddc6109dea38e1b812867728fe49c84db14bfd5e6a58d26e523695f848d6af060110ea48bc17fb63f629b444d39

                      • memory/1800-0-0x0000000001140000-0x0000000001141000-memory.dmp

                      • memory/1800-2-0x0000000000E40000-0x0000000000E41000-memory.dmp

                      • memory/1800-62-0x0000000000E45000-0x0000000000E56000-memory.dmp

                      • memory/1816-63-0x000007FEFB761000-0x000007FEFB763000-memory.dmp