Overview

overview

10

Static

static

1

3858_invoice.exe

windows7-x64

1

3858_invoice.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-05-2024 15:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3858_invoice.exe

  • Size

    25.8MB

  • MD5

    9b28351713f6b95a04996fee315aa7fd

  • SHA1

    edac4aa27925404263fafdaad6dd375732861ad1

  • SHA256

    39e246d194e4a5ade27a08d4a925dbff009fa8b66963c05f18712c1472e24a81

  • SHA512

    7971eacbb3e56be9803abcd11f9fd3246ba763b16de5d3331e984b040c2c9730a9ba085ed1a7d0ae0d24bd28ed108938284111c8f65d011ee0e62c6c2c4fc624

  • SSDEEP

    393216:M+Jsv6tWKFdu9CRXu3AzmqTL6zemNMg56LLnToMjmmV5BBWCJP0/3uj7XlC4t6no:RfmqG3Q3TTyanWCJM/e9Ch6dv

Score
10/10
egregordiscoverypersistenceransomware

Malware Config

Signatures

  • Detected Egregor ransomware 1 IoCs
  • Egregor Ransomware

    Variant of the Sekhmet ransomware first seen in September 2020.

    ransomwareegregor
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 8 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 52 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3858_invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\3858_invoice.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe" -regsvc
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks system information in the registry
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 1512 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572" -ApplicationType 4
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4312
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe" -InstallVDD
      2⤵
      • Executes dropped EXE
      • Checks system information in the registry
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      PID:3164
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\3858_invoice.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\3858_invoice.exe""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3280
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:1124
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:4028
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • Delays execution with timeout.exe
        PID:2088
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bfc2a775-842c-fb43-badb-3670e0543e8e}\g2rvdd.inf" "9" "415529917" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4304
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
    1⤵
      PID:2328
    • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572" -ApplicationType "4"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
        "C:/Program Files (x86)/GoTo Resolve Unattended/1937918270322737572/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "2576" "-WtsStartingUsername" "-ServiceName" "GoToResolve_1937918270322737572" "-Service"
        2⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Checks system information in the registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveLoggerProcess.exe
          GoToResolveLoggerProcess.exe -ParentProcessId 552 -CompanyId 1937918270322737572 -InstallationId 0pMLemIe8f -MonitoringUrl https://dumpster.console.gotoresolve.com -HostId 9cdfa031c1992a13820809d8cd095cb8 -LogLevel 2 -MonitoringApiKey cnl6269ktie1dcpmz8y2ddxhjhhgi0nebxwpr4a3c71lbfwnubk2w7l7c6evabi3 -SessionType Unattended
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:5072
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:/Program Files (x86)/GoTo Resolve Unattended/1937918270322737572\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Gylqwjcn --annotation=installationid=0pMLemIe8f --annotation=version=1.15.2.3338 --initial-client-data=0x4d0,0x4d4,0x4d8,0x4a4,0x4dc,0x7451e09c,0x7451e0ac,0x7451e0bc
            4⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:3500
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Gylqwjcn --annotation=installationid=0pMLemIe8f --annotation=version=1.15.2.3338 --initial-client-data=0x55c,0x558,0x58c,0x52c,0x588,0x7451e09c,0x7451e0ac,0x7451e0bc
          3⤵
          • Executes dropped EXE
          PID:3488
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveFileManager.exe
          GoToResolveFileManager.exe -CompanyId 1937918270322737572 -InstallationId 0pMLemIe8f -LogLevel 2 -MonitoringUrl https://dumpster.console.gotoresolve.com
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Gylqwjcn --annotation=installationid=0pMLemIe8f --annotation=version=1.15.2.3338 --initial-client-data=0x5f0,0x5f4,0x5f8,0x5c4,0x5fc,0x7451e09c,0x7451e0ac,0x7451e0bc
            4⤵
            • Executes dropped EXE
            PID:2764
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveQuickView.exe
          GoToResolveQuickView.exe -InstallationId 0pMLemIe8f -LogLevel 2
          3⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks system information in the registry
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4420
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTerminal.exe
          GoToResolveTerminal.exe -CompanyId 1937918270322737572 -InstallationId 0pMLemIe8f -LogLevel 2 -MonitoringUrl https://dumpster.console.gotoresolve.com
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
            "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Gylqwjcn --annotation=installationid=0pMLemIe8f --annotation=version=1.15.2.3338 --initial-client-data=0x5f8,0x5fc,0x600,0x5d4,0x604,0x7451e09c,0x7451e0ac,0x7451e0bc
            4⤵
            • Executes dropped EXE
            PID:1500
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:5644
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          PID:6080
        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\1.2024.0507.5\GoTo.Resolve.PatchManagement.Client.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\1.2024.0507.5\GoTo.Resolve.PatchManagement.Client.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\PatchManagementModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\Windows\SYSTEM32\where.exe
            "where" -r "C:\Program Files\WindowsApps" Winget.exe
            4⤵
              PID:776
            • C:\Windows\SYSTEM32\where.exe
              "where" -r "C:\Program Files\WindowsApps" AppInstallerCLI.exe
              4⤵
                PID:5348
            • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe
              "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:6020
            • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
              "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
              3⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              PID:5256
            • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
              "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
              3⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              PID:5500
            • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
              "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
              3⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              PID:4288
            • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe
              "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\GoTo.Resolve.Alerts.Monitor.App.exe" --Credentials:CompanyId 1937918270322737572 --Credentials:HostId syn-prd-ava-unattended-c0ccaa6c-8077-4af5-b0c4-59fb1daf18db --Communication:IpcFolderPath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\IPC" --Authentication:TokenFilePath "C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\token.txt" --ZeroTrust:ReferencePublicKeyHash 79297ed57ba94f2dde0d121e431d4ed4d8f143a35e3f89ed9b9c2fc1c3015ae8 --Native:Version 1.15.2.3338
              3⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              PID:3864
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start GoToResolve_1937918270322737572
          1⤵
          • Launches sc.exe
          PID:5216

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~2\GOTORE~1\193791~1\x64\g2rvdd.cat
          Filesize

          10KB

          MD5

          8d2c58325f63af51d37693e7ffbdbc4d

          SHA1

          ea0507cdf4528faa174eb5883eb20b90363ed512

          SHA256

          6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be

          SHA512

          71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62

          Download Submit

        • C:\PROGRA~2\GOTORE~1\193791~1\x64\g2rvdd.dll
          Filesize

          141KB

          MD5

          e00f914a13981678cc130f7c65807f03

          SHA1

          0a00739f6f2b1c57946fc09f084deb5bd3d9e342

          SHA256

          484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8

          SHA512

          ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\FileManager.dll
          Filesize

          16.1MB

          MD5

          d3fa69a91fe17f9c4523d8fad2992f78

          SHA1

          d2a353b94ba3d718a489af7fe72cc858b74fe87e

          SHA256

          94df392a600acb29ff711f164073c1c80bbcf270dcc5a4cd8cba8e762b1ae40f

          SHA512

          cf2b0898bbf783e49112c61a7373c896856c5e5777d229b791804b29ab288f7613c5a67f4ebf38389d9b9c2100b88e93489a8d8aae68b090d9c7d6283d647e86

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveCrashHandler.exe
          Filesize

          1.1MB

          MD5

          c6e96dd2f500e4b3cedf7e627015e032

          SHA1

          35ea9753ca13c92971eff137c1cee613c0e93cab

          SHA256

          2b4556e9c709e1da52cab89aa754fab86c7bb5265e63850dc133dc4ca387fc70

          SHA512

          06e557d87fed5a1ff9d5d6a520429f6dc6d97e3f2952524ce30af5c25b017d39c15ce189092d0a9234c827510a07020cd31b9d172d60a8fdae6ad3f430b6339d

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveFileManager.exe
          Filesize

          109KB

          MD5

          62912afba6014da200e40c49f685f084

          SHA1

          38e4bd808305bf4b41c10da91daea49587743e32

          SHA256

          b2fc90c66d76aa33da449039e6ea5f66b43880b3ef86e7ae263e1e113f7c3296

          SHA512

          351938c08a92b663727ffb3b2f4a3377104013b3680f7ccd60394463c3b8992ea0e6115ebe847e0cfd9dba942c219af51de334204b2afdcc663a15901a81603f

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveLoggerProcess.exe
          Filesize

          109KB

          MD5

          d319e53da0d6ea80140611a19dd6c468

          SHA1

          e47768dbad5bc1bf81bd9f135c9d7a4f62de4573

          SHA256

          dc21f66e9dd2ca56504c3dcc02862117f2da94f212b289d3b09349bc59f57a25

          SHA512

          092617eb831cde6da475a759f9962c94ca70b78905f892a3a798a21cfe8d1e8e50d72dd0d2cdc89949a5f81e6a5d85b1597712112934a3ffab271b750089e32b

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveProcessChecker.exe
          Filesize

          107KB

          MD5

          5145ef194fdd47be876847e9b9534cdc

          SHA1

          34711371a01494b7432528821c75bd5fcfe851a4

          SHA256

          34e6f7d1fd0aa8b20cb8cac184b8ecd90c157ccc62e38568699efa10c411c7ea

          SHA512

          7e5fdaea1bb2501bc52801c11f36bbd6d165282eb920cddaba59a5c5999be57032a5e9f2b5196f54b300c51ae99381e7e1c831fa73422e0065174385a3ef6757

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveTools64.exe
          Filesize

          1.3MB

          MD5

          c3d3d6a881753584b29d60f4c5b6a965

          SHA1

          0952c70ea06b932a6c20cf8af10d3aa281880b7c

          SHA256

          f36b1c32a5fa8969422d99042287685634bb8d85c9643100032e9df5744dd39e

          SHA512

          5d1ebc3603690d1534d0624ffb73f947d1afe48f407540e07810df89ab737b47a1728a1829f9207be26bf03c2da3e7097ab8aedf31b212fc25ffe2ed632edcbf

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\GoToResolveUnattended.exe
          Filesize

          109KB

          MD5

          0e688254065af78d95a3fdf159ab8d86

          SHA1

          e1178f76ea31e1009f631ca0f0b948807392faa9

          SHA256

          1b6fc8321728fccd3a9a0f88f51ab115f0c6d227d644b948d9d0b58d1123c923

          SHA512

          71efb2e36026fd859522c593662ac7f607ad639027c0fa6cc2f4fc9e0c0bc9156ca4e90448f3e2795d693bad0d337b28147bea33747687524da70e598ddb430c

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\LibGoToResolve.dll
          Filesize

          19.7MB

          MD5

          c2b7eec9b082f83609d40a977c980c09

          SHA1

          e68345a8387c9644e1cc695ea1f8273e2911c63b

          SHA256

          1f13a2911d6cad19314f330bab9a57d81c8323575fdc7182e1c2eb6f844ba89b

          SHA512

          e0032b2acd49f20def25e799c39c7d9648e55250fb851c64b7a52b29aecfb5a3f8a83ded6963e221d16259b0e064504f92f1991a53c1e6a1a01044136e53de4e

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\MediaClientLib.dll
          Filesize

          13.9MB

          MD5

          12c3b59bbafa6ea8d0d3209e70ad39c2

          SHA1

          7f699dd519c20ecf8bf24947d03868c580913b39

          SHA256

          c132232018896ba3f84ff37a1ece4a7a58eef08afecf495fc31176b276b000bb

          SHA512

          55ebe552343ef28939d427f32e5ed98d11d734a65e050917e918efdf400806bbf809d8fc77beb48b6d2f4f5c7961f0c2c8a728691c4f217427578476bf64b10f

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\PasswordPrivacyDll.dll
          Filesize

          1.1MB

          MD5

          7a5ddf82d45f1060ac2386bf4ba89dd3

          SHA1

          ca26ead1e092c6612d7393873854ba0a257ae832

          SHA256

          95743c6c9d2f626fa66c3b95e2b3c003313089f653681c82c1e9c214ddd2778d

          SHA512

          5ad98d4985d36d6259027374c600913a5729635c71453c6191510ac1c4f3b9b732c6436eb49b9c0ddb2af753b08c699c1ca6c26c151cf52fce9cdb2b5a77bd5d

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveProcessChecker.log
          Filesize

          4KB

          MD5

          7a3f94335c9fc40294c5b21f507c9d07

          SHA1

          4a583ad4d58b81daa435b7fb89a513c301530a4e

          SHA256

          8e2700f7518be5bbab36bc75713cab37ce2a0bb25450ba80815d36452c059ae8

          SHA512

          c526d250c30c77eda62399f41dd3202efe4951c79fe31365c28d411b6fefc153a9e795bdf183ac79a1be76c9dda6f58b3fc6b212df72c28963e427c082bf70f7

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\appdata\GoToResolveUnattended.log
          Filesize

          18KB

          MD5

          5122a9f5eccf450074b2d3037a9d62dc

          SHA1

          ed7a9733b758350d7af1c584cebc75c17867d635

          SHA256

          08da0a4a8a2cdc1179ee176a566444519f51d0471e7449568c87dfbf95eea54a

          SHA512

          ad87419eb42e05a67d247aab9a0e63df7f84a11dc006e0cc72fed6bbf3b011cec04a3df1358862d9f410e7a216987d37f2998d895a593d00e4daeed7840e46e1

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\logs\2024-05-16.log
          Filesize

          4KB

          MD5

          c74e9d8becc7adb32d080483fd874767

          SHA1

          3dc68b3c000627d3fe057ce525e26587ba950582

          SHA256

          104700bdc5f14cdeedddcafaae0128699f1679777c7932dbc41fec3a7a791d8d

          SHA512

          7521d4daadf29420602ae89530838e9069614e1bb8618ab52ee0746dd54062b5d0df18e476755e782fb15386dd9927c9348311eedfb4c43b285cecf3923de919

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AlertsModule\1.2024.0430.2\logs\2024-05-16.log
          Filesize

          1KB

          MD5

          8af60c8842ca20903f06cdcfb630c2d3

          SHA1

          dfc60d57e5aa79c16eea0590403aec2b54abe2f3

          SHA256

          dbb291e6bfbf2fe586ca06eeb46e5629f626e418627a4aa8708e68db3562946d

          SHA512

          f8c017224fcd39d8d962fff10acbec3f59e44d906f330f4389fb091727320d6ddcf4316c101f9daede73c355809d22095d2e9d734471fb27e6812395f16fb09e

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\AntivirusModule\1.2024.0411.2\GoTo.Resolve.Antivirus.App.exe
          Filesize

          161KB

          MD5

          0ee709e29bad3bf3677eb380ae9fe100

          SHA1

          655d7ae9fbce8f5ec9fb1ebbf1edd34a7fcb0501

          SHA256

          7680070e0ba04e4219943cf513cdb004cd20aa5fcccf9644b8caa1cdf9a3f4fc

          SHA512

          5e0fabb74c25864f5fc6f2fd44aa0ed1337745c66246ae3e48d6ec0c1a1d18b718fc9e2d3d34cae974434a8f8625de9ff6615e6d4c8a55b0132ffbf6b0f469d7

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\DeviceDataModule\1.71.0\GoTo.Resolve.DeviceData.App.exe
          Filesize

          11.5MB

          MD5

          5c76b75ea22c81a9224456f77ab1175f

          SHA1

          b681216752e17148d341390d1c778e4c5ba33364

          SHA256

          0bc404e30bdad9be1d7ed633adc054800f2e7e757e6414795136c0a896b0bb87

          SHA512

          a18172f9ba6f6ee62c64cd4f506791c9592436a7cd9f06710794e86a26748bd6d51406420cfc89474fe0c1375e56f3ce1ccc834cd1799a5cc7decadcf63eef0a

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\externalmodules\RemoteExecutionModule\1.2024.0506.1\RemoteExecution.Runner.exe
          Filesize

          164KB

          MD5

          840ed278c7882f3b877df906937aa3c5

          SHA1

          0262be6cd5f1596e5b54ecc910efd6e277920c03

          SHA256

          8f70badc067ff6e828d6afccaead174a7623a8ef89c1c81a614f5fa8648f1019

          SHA512

          2e2ae3b5ba9b9394f386c2243da93ad3f7f35102f50be2206bf06cd48401bb8de5e1fb4ab18b29fa53ad8530474fdef3490df98aca7bc3ba2295485b911630c2

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\libcrypto-3.dll
          Filesize

          4.2MB

          MD5

          dc2bd7e6e6a3b528424410af077ba2a7

          SHA1

          aa891f61820e7c6d0ed35989a595af77f4b7203b

          SHA256

          e852018ec59efbe2dc2e32c064f35ee68171417d8c5bc5ba319609555dde2bc6

          SHA512

          a96f57f5d0272f8ba4ccb1b184289f0caeace54d001f641622fe38892fa9d0f6781808cf5a585d77fc75c356bb90c03a062b2fb17b09a29e20b0264b12c8358f

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\libssl-3.dll
          Filesize

          1.1MB

          MD5

          4f19c36b09b820d9371d8b6510497475

          SHA1

          03b8ee682eeac39e120aac474a54344c2b391150

          SHA256

          11598140036154dcd8ccd5619ac059aea4012cf9a4535ffa7c9b2f0ae405906d

          SHA512

          8ed2ee897c54abf13beae299902018861c4bc30a1ce5d14a64129af3856a3d2e5829eb060a99f7ea7bb894966e21a2d5eec473323883c865c0caed9de832d1b6

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\logger.json.tmp
          Filesize

          374B

          MD5

          7f7e7cfc56525eb1fc5d9fbe3c1f1e62

          SHA1

          f8d2fba1420479b32750f0584dd5269a8378a882

          SHA256

          b7c01c84dec661cddc8efebdfc5048532d794edc1d41822e583ba4b4d7f74f61

          SHA512

          337c6f81b300589145c7763df531ac681de376beae2e8f2051fea5aad6a1cdc11a34dc280a6efa3be52ec67e596a00ee977bec7cff7353d64ce388aa477a9a4f

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\mandatory.json
          Filesize

          74B

          MD5

          f50767df127a399996304f5a1259653a

          SHA1

          0a03f644be27865e0031b235ca6a21353e265ed7

          SHA256

          afc6a427fd31151d995e93e66edd9138df27dc88580b03b12d8a8012c481f3bd

          SHA512

          29898528d9047d2689de8be7938662c0e80c5161c20fcb9fa9135378b2c2193c6185cd560148f3fd7100824f7f43265434d9982c1b85933f3d00490804c7853e

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\mandatory.json.tmp
          Filesize

          1KB

          MD5

          c0b2d3a1d0aed89f170276a442fece1b

          SHA1

          9d80a1f2bac4724bdcc6da4459c1a3d73f662c83

          SHA256

          2864ba7550db49bc7bbf5695b89884cc00accb519110d7bfaafce0aae8be657c

          SHA512

          e7b80826a6a567d0f7ac780b49f0f7f5376b89f10dee431ef2a2277cc8bb2fca94691821f8d48f088fd87da4008fb7400b093219ff0d1c2d890689be5c54da43

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json
          Filesize

          582B

          MD5

          c5b571903e37d2b955cd21f584471ed3

          SHA1

          267332217a876f04c16e8b92141fa8321dd6fc74

          SHA256

          f967768b99cebe2225ef1c41d9ee31c21f9014f87f29cf30c487b448aa074dfa

          SHA512

          e849d1bfceaa9450505c27119ec407d19b017a3748d907c73fcb915b46fbf7b1bb75c85be066d8898cdbda0d942389c965f2102522cd049211269f4ba4cdac3a

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
          Filesize

          703B

          MD5

          49271953cc7e7b5b920c292bd93026c1

          SHA1

          bddb772d4c859a56bea173c61023f973600d4bd8

          SHA256

          19eb67cc4ed0b294ba19f7ff2ab3c3f616cb05f27b9d6b87071fa52b9754b8ef

          SHA512

          d8e74aaf6eb247b64f2881711cd15d490a21373a197142aa9edb6593fed1d39b44e38c7783621b47b56b78861920dba720d311ad601150905f2365544acbf224

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
          Filesize

          1KB

          MD5

          b7113cb874b2f8642f4627e8f070c37e

          SHA1

          b1c50de8801aca63bf17acad562e340b888884ee

          SHA256

          71c7275a2fab14b04888d94d2c5af1389b48b5e330427e5d32ad1e2283323e85

          SHA512

          3cc1536b5bf86d8db690cda85f6389845972b977db475214bafd1a9da9199a64deac9a830f9ec748ec2259b6fc3b946d057d259cdbd9ca8aadd08d111c51966f

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
          Filesize

          1KB

          MD5

          70dfff020b12d56d5607284a91cf2e3b

          SHA1

          c73cfc5c2293ad38c361fd5d90226f9eef9a0837

          SHA256

          88d841af1e757a2264bd0b30cca2b385de84de1672073ca23ffc5155889838b2

          SHA512

          263242344d60ea20d392f1587f75b1f07e1c470de431452e2182e33607cf4cb6e046d0b5dbc1f90a461cea090a4f5098449c0716d0d79255a838dabc3494d104

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
          Filesize

          1KB

          MD5

          1fc328391705fd73db50d6c1064b7a25

          SHA1

          4f2de52ab9da8767c66c1c29d76d35a20ca83582

          SHA256

          8bd3e912ca3639405e98903a0d2be6665f13af2fc1a837064621d375131791d2

          SHA512

          4ee070e5ea9cdd644d1d031e13f6731bcb31cec45ebbb8abdffd1bfe068137e759c13633e8c5adbf4d54f9bae0c1de40ed1dcd1dd66527c746dcbbf20c73c664

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\unattended.json.tmp
          Filesize

          1KB

          MD5

          baa2cf3f49491954b931d27269f07e15

          SHA1

          e673ae65634dd64f2332f0d95103894df8933b8f

          SHA256

          479c33838f1420181be974b548ed253c6d4bf9684117740dc5d578e95bf8ba37

          SHA512

          3c1b8e51cae527a406ebcfbed064c8b74b3f39b986d9ba7dcb54d6bcf63f099e4ff0be6f4c8c8dcbdec39b1fae924272ba327ca1bb9af877bca2bb2c28a2315c

          Download Submit

        • C:\Program Files (x86)\GoTo Resolve Unattended\1937918270322737572\x64\g2rvdd.inf
          Filesize

          3KB

          MD5

          79c299099a8f43e1a94047355ebdf1cc

          SHA1

          55ede099780c9e2dcc8cb3dd9006fbf098c8997b

          SHA256

          0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d

          SHA512

          270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d

          Download Submit

        • C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
          Filesize

          3KB

          MD5

          838ca896ea193a6baf562c295871addd

          SHA1

          c240fc0d4993dd6ea39fcc2c93a6709ce2da0235

          SHA256

          e34644372681bcb14460b43a98875bf8ab7e8fd966141c8401f0882518b1f0b6

          SHA512

          d597800ced83381ef60a461e34fe154d91b9e18c9dd707af266510b6e1fd84897129c09c57d2098dd5dd10ebf54bd772f445074c430ca1b86400e6819a79e8f3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\3858_invoice.exe.cmd
          Filesize

          537B

          MD5

          2d1ec5c3d0d2fd67e0aa148f4e523d93

          SHA1

          24a6528837fe7c825f44be9e0c2bd942203bb9b0

          SHA256

          5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b

          SHA512

          7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25

          Download Submit

        • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\ApplicationInsights\bf35fe7d15f2a58d930da8c8f390b78245b9136f9bb24b2713ab881c60fe52f1\vlk3i5ma.w1r
          Filesize

          1B

          MD5

          93b885adfe0da089cdf634904fd59f71

          SHA1

          5ba93c9db0cff93f52b521d7420e43f6eda2784f

          SHA256

          6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

          SHA512

          b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

          Download Submit