Overview

overview

7

Static

static

7

Access_Documents.exe

windows10-2004-x64

7

Access_Documents.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Access_Documents.exe
  • Size 23.3MB
  • Sample260704-phj7sae191
  • SHA256 9d0f757af542331cd7208026383fa2fcc8ddbf2ada37592910b96195c4a2f1c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
backdoordefense_evasiondiscoverypersistenceprivilege_escalationrat

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • GoToResolve remote administration tool 1 IoCs

    GoToResolve is a remote administration tool that can be used as a backdoor

    backdoorrat
  • Drops file in System32 directory 43 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 12 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Executes dropped EXE 32 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 52 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 9 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe
    "C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3552
    • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe" -regsvc
      2⤵
      • Checks system information in the registry
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5856
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 5856 -InstallationId 92pLtBgQ0R -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -ApplicationType 4 -Environment "Production" -ForceInstall 0
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4236
    • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe" -InstallVDD
      2⤵
      • Drops file in System32 directory
      • Checks system information in the registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:6952
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=version=1.24.0.142 --initial-client-data=0x31c,0x328,0x32c,0x320,0x330,0x7ff637c3baf8,0x7ff637c3bb10,0x7ff637c3bb28
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6416
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:7008
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:7160
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:6124
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 3
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:4588
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b2e80fca-4b94-0c41-8c32-40e15aede90d}\g2rvdd.inf" "9" "485c3f42b" "0000000000000180" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:2404
  • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe
    "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -ApplicationType "4"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:6000
    • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x860,0x864,0x868,0x7fc,0x86c,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:5536
    • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe
      "C:/Program Files (x86)/GoTo Resolve Unattended/4535335282478998551/GoToResolveUnattended.exe" "-RegisteredProcess" "1" "-ParentProcessId" "6000" "-InstallationId" "92pLtBgQ0R" "-WtsStartingSessionId" "1" "-ServiceName" "GoToResolve_4535335282478998551" "-Service" "-LogLevel" "2"
      2⤵
      • Drops file in System32 directory
      • Checks system information in the registry
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveLoggerProcess.exe
        GoToResolveLoggerProcess.exe -ParentProcessId 5024 -CompanyId 4535335282478998551 -InstallationId 92pLtBgQ0R -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -Environment Production -ApplicationType 4 -HostId 4abec83a525e0c781e56a90c720e692f -LogLevel 2 -SessionType Unattended
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:476
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveLoggerProcess.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveLoggerProcess.log" "--attachment=attachment_logger.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\logger.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x724,0x728,0x72c,0x6fc,0x730,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Executes dropped EXE
          PID:5344
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattended.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x7d8,0x7dc,0x7e0,0x79c,0x7e4,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        PID:5220
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveExternalModuleHandler.exe" -InstallationId 92pLtBgQ0R -CompanyId 4535335282478998551 -publickey 1a1b52cf4c7aba62e657c86541120c578ceaa2b79c2365f29f3c763bedbdd8b9 -LogLevel 2 -Environment Production
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:7044
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ExternalModuleHandlerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x728,0x72c,0x730,0x700,0x734,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:5520
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveFileManager.exe
        GoToResolveFileManager.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId 92pLtBgQ0R -LogLevel 2
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6852
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\FileManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7b8,0x840,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:2076
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveQuickView.exe
        GoToResolveQuickView.exe -InstallationId 92pLtBgQ0R -LogLevel 2 -Environment Production
        3⤵
        • Checks BIOS information in registry
        • Checks system information in the registry
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\QuickViewCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x76c,0x770,0x774,0x750,0x778,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Executes dropped EXE
          PID:2832
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTerminal.exe
        GoToResolveTerminal.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId 92pLtBgQ0R -LogLevel 2
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1540
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\TerminalCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7c4,0x840,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:620
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveServiceManager.exe
        GoToResolveServiceManager.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId 92pLtBgQ0R -LogLevel 2
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:692
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\ServiceManagerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7b0,0x840,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:6820
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRemoteControl.exe
        GoToResolveRemoteControl.exe -CompanyId 4535335282478998551 -InstallationId 92pLtBgQ0R -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" -Environment Production -ApplicationType 4 -LogLevel 2 -Service 1
        3⤵
        • Checks system information in the registry
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2016
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveRemoteControl.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveRemoteControl.log" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x774,0x778,0x77c,0x6e8,0x780,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Executes dropped EXE
          PID:5092
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRegistryEditor.exe
        GoToResolveRegistryEditor.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId 92pLtBgQ0R -LogLevel 2
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:460
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7c4,0x840,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:3412
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveNetworkChecker.exe
        GoToResolveNetworkChecker.exe -BaseUrl https://devices-iot.console.gotoresolve.com/ -SessionBackendUrl https://sessions.console.gotoresolve.com -WebsiteUrl devices-iot.console.gotoresolve.com -LogLevel 2 -ApplicationType 4 -InstallationId 92pLtBgQ0R -CompanyId 4535335282478998551 -Environment Production
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5636
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\NetworkCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x72c,0x730,0x734,0x708,0x738,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Executes dropped EXE
          PID:5900
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GoTo Resolve Unattended\cleanup0790.bat" "
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:7016
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:7112
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6516
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:6356
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4084
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveRegistryEditor.exe
        GoToResolveRegistryEditor.exe -CompanyId 4535335282478998551 -Environment Production -InstallationId 92pLtBgQ0R -LogLevel 2
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5348
        • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
          "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\RegistryEditorCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x834,0x838,0x83c,0x7c4,0x840,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          PID:2968
    • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattendedUi.exe
      "C:/Program Files (x86)/GoTo Resolve Unattended/4535335282478998551/GoToResolveUnattendedUi.exe" "-CompanyId" "4535335282478998551" "-InstallationId" "92pLtBgQ0R" "-WorkFolder" "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551" "-Environment" "Production" "-ApplicationType" "4" "-Lang" "en" "-WebsiteUrl" "devices-iot.console.gotoresolve.com"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:6260
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--attachment=attachment_GoToResolveUnattendedUi.log=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattendedUi.log" "--attachment=attachment_unattended.json=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=installationid=92pLtBgQ0R --annotation=version=1.27.1.3232 --initial-client-data=0x754,0x758,0x75c,0x738,0x760,0x6fbb6fac,0x6fbb6fbc,0x6fbb6fcc
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3936
    • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe" -UninstallVDD
      2⤵
      • Drops file in System32 directory
      • Checks system information in the registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
        "C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Ejugbctc --annotation=version=1.24.0.142 --initial-client-data=0x324,0x328,0x32c,0x304,0x330,0x7ff637c3baf8,0x7ff637c3bb10,0x7ff637c3bb28
        3⤵
        • Executes dropped EXE
        PID:6892
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe
    1⤵
    • Launches sc.exe
    PID:3464
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf" "0" "4b36357d7" "0000000000000190" "Service-0x0-3e7$\Default"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        g2rvdd.cat
        • Path C:\PROGRA~2\GOTORE~1\453533~1\x64\g2rvdd.cat
        • Size 10KB
        • SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        g2rvdd.dll
        • Path C:\PROGRA~2\GOTORE~1\453533~1\x64\g2rvdd.dll
        • Size 141KB
        • SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FileManager.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\FileManager.dll
        • Size 16.2MB
        • SHA256 fa0b23cbb92d9f312e07fd34e9cca29f7f07f857c66437eac688884982c9772a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveCrashHandler.exe
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveCrashHandler.exe
        • Size 652KB
        • SHA256 a0644b882b60bd2dbc7654214860f9a5776164a70af2d603542880ad87452635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveLoggerProcess.exe
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveLoggerProcess.exe
        • Size 409KB
        • SHA256 ad8d0f667f2cfd8807516bc9bcf40f29d993f8c4e67cc4db0764ae2ce15911b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveProcessChecker.exe
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveProcessChecker.exe
        • Size 409KB
        • SHA256 7d25e75bf4fca99b065a8125dba764329c1239e645135d730f58c6a05fcf58bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveTools64.exe
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveTools64.exe
        • Size 1.3MB
        • SHA256 bf9bee413575081ea147e0cdb55928dd5eda36659ee01c0e2600a3168ec488f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveUnattended.exe
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\GoToResolveUnattended.exe
        • Size 409KB
        • SHA256 3e8b4470dac0f618de1c8e586afd35ff903bcdc3d7d0cfcb69065279340d18a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LibGoToResolve.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\LibGoToResolve.dll
        • Size 19.5MB
        • SHA256 ddf3244decb29688d6a1972d3004f92bd365700bc77606efce8013a3677c6a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MediaClientLib.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\MediaClientLib.dll
        • Size 14.0MB
        • SHA256 16729d5e7273b72c0fa05d08734f558c9da7f939900dcf38c1356edbbdade0c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PasswordPrivacyDll.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\PasswordPrivacyDll.dll
        • Size 1.1MB
        • SHA256 e0f942c604cb38c00ea5ed9bc5e1b2110678118eea1e7d8d45c52e13b45e2100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveProcessChecker.log
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveProcessChecker.log
        • Size 4KB
        • SHA256 99262e2b0a7b612aaefd8392e32831129316ccb3f1d4645b9495dcbc2a1fa744
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoToResolveUnattended.log
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\GoToResolveUnattended.log
        • Size 2KB
        • SHA256 ede2d69cb765e9c1383e803c7518b3312562e95bc7d8b3ee6954fc480bb1cba5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        fbf08f1d-0b5a-4f0b-9ca0-8109f218a766.dmp
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\appdata\UnattendedUiCrashReportDB\reports\fbf08f1d-0b5a-4f0b-9ca0-8109f218a766.dmp
        • Size 258KB
        • SHA256 c4aecec5357133c57b973894efe85103110cebed6d8799161aa5809412f9de5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3-x64.dll
        • Size 5.8MB
        • SHA256 7667612b7ee8efd38b87050f6a58b291831a90310c9a72b08179e66eec55b9d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libcrypto-3.dll
        • Size 4.2MB
        • SHA256 20725b213874d4f8781fe86bc2dbd4d552b0c57a2408638feedcccc646b2104a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\libssl-3.dll
        • Size 1.1MB
        • SHA256 9f41e26e3f2470e0874d581a7f56b5053797ff53874e491bbbb449d3d7998daf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mandatory.json
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\mandatory.json
        • Size 1KB
        • SHA256 4c6578637b192a91a84909661b9f89befaa5d5756f837bb4e7d54fcce8b2e9ed
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        unattended.json
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json
        • Size 697B
        • SHA256 232496d23b4620c969c06729b8eb50e62591b602bf337549baa9a905a5de103c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        unattended.json
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\unattended.json
        • Size 1KB
        • SHA256 880f3c6035f2ae34d643abaf1c79b1d6be250f3bd9011c88f39f4f56b2768091
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        g2rvdd.inf
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\4535335282478998551\x64\g2rvdd.inf
        • Size 3KB
        • SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cleanup0790.bat
        • Path C:\Program Files (x86)\GoTo Resolve Unattended\cleanup0790.bat
        • Size 206B
        • SHA256 3019dec0c9f7bbb83589cecd636a4d4f9bfbd5e49d24287fda0ecb2f64cda957
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
        • Size 727B
        • SHA256 4f97c6c747503feea334f9714d408bb9a15e8f68e21b849ca79be37bbf34426e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
        • Size 727B
        • SHA256 5a2ea87f8f887c990c8594b377a38b3ac1ec44b20e4f38bd15eb6b5a6fc3aa7d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
        • Size 400B
        • SHA256 f8658b0f52cc2de6a2dfac4e1c98c2126741b05be5c4a5abf7906179b4225cc6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
        • Size 408B
        • SHA256 e8c6798f5a33f8e0f232de4460a84df05d926cc16aba5331e1e93d8a6c07b6fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Access_Documents.exe.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\Access_Documents.exe.cmd
        • Size 537B
        • SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
        • Size 400B
        • SHA256 e95f0fce06b948b1209cd0628824effe431e63f85749210e26adfcde7f60b9a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
        • Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
        • Size 408B
        • SHA256 23fba85be1c9bf5ec7f3e2ef514d859e952a443261eca3fc1e37905a1b77b9ba
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        g2rvdd.inf_amd64_5e96164a846f7842.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842.ini
        • Size 413B
        • SHA256 5ccbaaae6b297509f1b3acc1ed66ed4d0c25edc103b83ee927f83597f11854c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download