Overview
overview
7Static
static
1IIB8YG/Log...ed.msi
windows10-2004-x64
7IIB8YG/Log...ed.msi
windows11-ltsc_2024-x64
7IIB8YG/install.vbs
windows10-2004-x64
7IIB8YG/install.vbs
windows11-ltsc_2024-x64
7IIB8YG/z.pdf
windows10-2004-x64
3IIB8YG/z.pdf
windows11-ltsc_2024-x64
3SWIFT_MT10...52.vbs
windows10-2004-x64
5SWIFT_MT10...52.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...05.vbs
windows10-2004-x64
5SWIFT_MT10...05.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...02.vbs
windows10-2004-x64
5SWIFT_MT10...02.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...37.vbs
windows10-2004-x64
5SWIFT_MT10...37.vbs
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 07:15
Static task
static1
Behavioral task
behavioral1
Sample
IIB8YG/LogMeInResolve_Unattended.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
IIB8YG/LogMeInResolve_Unattended.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
IIB8YG/install.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral4
Sample
IIB8YG/install.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
Behavioral task
behavioral5
Sample
IIB8YG/z.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
IIB8YG/z.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_67484552.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_67484552.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_98174105.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_98174105.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_45614702.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_45614702.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
SWIFT_MT103_PAYMENT_04.pdf _18284437.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
SWIFT_MT103_PAYMENT_04.pdf _18284437.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target IIB8YG/install.vbs
- Size 7KB
- Sample260730-h3edpsep4s
- SHA256 66cd2d2a533b9ac820fd8c760e8390274e02ca0c96c3646786383102f2b76545
- MD5 d2567038bfcd724a1992159cba3f6f55
- SHA1 79a2f57da31229293cbdbccd1eae0a67751e472e
- SHA512 d6d14d98d34f97c839a4c4400092a1ed29fd626a49df52565007bbb2cbe9d31176302f7c091cfaa8efae23f7501e65374019806650e21f86f876287c5de6ae6d
- SSDEEP 192:c1O5A2wy8J5HNBo2V+KvE+lKyFVrNPT+82OuTa4SfqPwY:cuA1bBa2MKvEYKyFVrNPT+1OmIY
- TLSH T1EDF19257BEA3433096D384A891AA0C2D96E6D727506B4492FFDC48941F18BFD93F08D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 7 IoCs
pid Process 4308 unattended-updater.exe 224 GoToResolveUnattended.exe 2000 GoToResolveTools64.exe 2952 GoToResolveCrashHandler.exe 4564 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 2804 GoToResolveCrashHandler.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral3/files/0x000700000002466c-29.dat rat_gotoresolve - Loads dropped DLL 24 IoCs
pid Process 540 MsiExec.exe 540 MsiExec.exe 2000 GoToResolveTools64.exe 224 GoToResolveUnattended.exe 224 GoToResolveUnattended.exe 224 GoToResolveUnattended.exe 224 GoToResolveUnattended.exe 224 GoToResolveUnattended.exe 224 GoToResolveUnattended.exe 224 GoToResolveUnattended.exe 4564 GoToResolveProcessChecker.exe 4564 GoToResolveProcessChecker.exe 4564 GoToResolveProcessChecker.exe 4564 GoToResolveProcessChecker.exe 4564 GoToResolveProcessChecker.exe 4564 GoToResolveProcessChecker.exe 4564 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 4084 msiexec.exe 6 4084 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe - Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\SET8C7C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\SET8C7C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\SET8C7D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\SET8C7E.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\SET8C7E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\SET8C7D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\g2rvdd.inf DrvInst.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 2504 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\libjingle.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveServiceManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveEventViewer.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\WebRTC.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp GoToResolveUnattended.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM32.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\microsoft-gsl.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\Thalhammer-jwt-cpp.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\metadata GoToResolveCrashHandler.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattendedUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\gabime-spdlog.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveLoggerProcess.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnlock32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveFileManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.inf unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIscrhook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\openssl-openssl.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattendedRemover.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\chromium-crashpad.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveService.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\google-flatbuffers.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTerminal.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\Tencent-RapidJSON.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\legacy.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.cat unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json.tmp GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIscrhook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.cat unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveTools64.log GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveQuickView.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRegistryEditor.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRemoteControl.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll unattended-updater.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6C23.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI7397.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\e58677f.msi msiexec.exe File created C:\Windows\Installer\SourceHash{1A79EF7B-92DC-4473-9510-E71BBA20B2FC} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{1A79EF7B-92DC-4473-9510-E71BBA20B2FC}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{1A79EF7B-92DC-4473-9510-E71BBA20B2FC}\ProductIcon msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\e58677f.msi msiexec.exe File created C:\Windows\Installer\e586783.msi msiexec.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI7098.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4836 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1936 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2416 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveUnattended.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveUnattended.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe - Modifies registry class 25 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IIB8YG\\\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\B7FE97A1CD29374459017EB1AB022BCF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\PackageName = "LogMeInResolve_Unattended.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\IIB8YG\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings WScript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7FE97A1CD29374459017EB1AB022BCF msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\PackageCode = "439B1F76CB274674EBC315087F511227" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\Version = "19005440" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7FE97A1CD29374459017EB1AB022BCF\ProductFeature msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\ProductName = "LogMeIn Resolve Endpoint" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\ProductIcon = "C:\\Windows\\Installer\\{1A79EF7B-92DC-4473-9510-E71BBA20B2FC}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7FE97A1CD29374459017EB1AB022BCF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IIB8YG\\\\" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4084 msiexec.exe 4084 msiexec.exe 4308 unattended-updater.exe 4308 unattended-updater.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe 3188 GoToResolveProcessChecker.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4468 msiexec.exe Token: SeIncreaseQuotaPrivilege 4468 msiexec.exe Token: SeSecurityPrivilege 4084 msiexec.exe Token: SeCreateTokenPrivilege 4468 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4468 msiexec.exe Token: SeLockMemoryPrivilege 4468 msiexec.exe Token: SeIncreaseQuotaPrivilege 4468 msiexec.exe Token: SeMachineAccountPrivilege 4468 msiexec.exe Token: SeTcbPrivilege 4468 msiexec.exe Token: SeSecurityPrivilege 4468 msiexec.exe Token: SeTakeOwnershipPrivilege 4468 msiexec.exe Token: SeLoadDriverPrivilege 4468 msiexec.exe Token: SeSystemProfilePrivilege 4468 msiexec.exe Token: SeSystemtimePrivilege 4468 msiexec.exe Token: SeProfSingleProcessPrivilege 4468 msiexec.exe Token: SeIncBasePriorityPrivilege 4468 msiexec.exe Token: SeCreatePagefilePrivilege 4468 msiexec.exe Token: SeCreatePermanentPrivilege 4468 msiexec.exe Token: SeBackupPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4468 msiexec.exe Token: SeShutdownPrivilege 4468 msiexec.exe Token: SeDebugPrivilege 4468 msiexec.exe Token: SeAuditPrivilege 4468 msiexec.exe Token: SeSystemEnvironmentPrivilege 4468 msiexec.exe Token: SeChangeNotifyPrivilege 4468 msiexec.exe Token: SeRemoteShutdownPrivilege 4468 msiexec.exe Token: SeUndockPrivilege 4468 msiexec.exe Token: SeSyncAgentPrivilege 4468 msiexec.exe Token: SeEnableDelegationPrivilege 4468 msiexec.exe Token: SeManageVolumePrivilege 4468 msiexec.exe Token: SeImpersonatePrivilege 4468 msiexec.exe Token: SeCreateGlobalPrivilege 4468 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe Token: SeRestorePrivilege 4084 msiexec.exe Token: SeTakeOwnershipPrivilege 4084 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4508 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe 4508 AcroRd32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2504 wrote to memory of 4468 2504 WScript.exe 85 PID 4084 wrote to memory of 540 4084 msiexec.exe 88 PID 4084 wrote to memory of 4308 4084 msiexec.exe 89 PID 4308 wrote to memory of 224 4308 unattended-updater.exe 90 PID 4308 wrote to memory of 2000 4308 unattended-updater.exe 91 PID 4308 wrote to memory of 1936 4308 unattended-updater.exe 92 PID 2000 wrote to memory of 2952 2000 GoToResolveTools64.exe 94 PID 2504 wrote to memory of 4508 2504 WScript.exe 95 PID 1936 wrote to memory of 2416 1936 cmd.exe 97 PID 4264 wrote to memory of 392 4264 svchost.exe 98 PID 224 wrote to memory of 4564 224 GoToResolveUnattended.exe 102 PID 4508 wrote to memory of 1196 4508 AcroRd32.exe 103 PID 1196 wrote to memory of 2208 1196 RdrCEF.exe 105 PID 1196 wrote to memory of 2480 1196 RdrCEF.exe 106 PID 1196 wrote to memory of 2480 1196 RdrCEF.exe 106 PID 1196 wrote to memory of 4720 1196 RdrCEF.exe 107 PID 1196 wrote to memory of 4904 1196 RdrCEF.exe 108 PID 1196 wrote to memory of 4904 1196 RdrCEF.exe 108 PID 1196 wrote to memory of 3096 1196 RdrCEF.exe 109 PID 3188 wrote to memory of 2804 3188 GoToResolveProcessChecker.exe 110 PID 1196 wrote to memory of 3456 1196 RdrCEF.exe 112 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IIB8YG\install.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\IIB8YG\\LogMeInResolve_Unattended.msi" /quiet /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IIB8YG\z.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7BE3114267F304D7B57D811AB3395220 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=29E4744D679F60FB55AFFA2F4E63F016 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=29E4744D679F60FB55AFFA2F4E63F016 --renderer-client-id=2 --mojo-platform-channel-handle=1824 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:2480
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7BA6771B47FB683884B7F1F46DEC88CB --mojo-platform-channel-handle=2296 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4720
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=ADA73083F5CECDD37F7BED0819C9B8E5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=ADA73083F5CECDD37F7BED0819C9B8E5 --renderer-client-id=5 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4904
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=21E6E032A844362E6DEF5FCD2F9F3766 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3096
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=04AC2AC7C645B5E9716761257AEC2031 --mojo-platform-channel-handle=2348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3456
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6F9A2F86A28AC842D0361866ED4F14602⤵
- Loads dropped DLL
PID:540
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe"C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\IIB8YG\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{1A79EF7B-92DC-4473-9510-E71BBA20B2FC}" "-MsiUiLevel" "2"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\IIB8YG\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{1A79EF7B-92DC-4473-9510-E71BBA20B2FC}" "-MsiUiLevel" "2" "-installerFileName" "LogMeInResolve_Unattended.msi"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 224 -InstallationId gnlr682owS -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType 4 -Environment "Production" -ForceInstall 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:4564
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe" -InstallVDD3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=933514f9af1e25c1f6536ed4b7e23e8d --annotation=format=minidump --annotation=hostname=Rphjnylj --annotation=platform=win --annotation=version=1.27.1.1320 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x340,0x344,0x348,0x33c,0x34c,0x7ff6e833f8a8,0x7ff6e833f8c0,0x7ff6e833f8d84⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2952
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:2416
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf" "9" "4e1e440a3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:392
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType "4"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3719837408790104989 --annotation=component=Unattended --annotation=computerid=933514f9af1e25c1f6536ed4b7e23e8d --annotation=format=minidump --annotation=hostname=Rphjnylj --annotation=installationid=gnlr682owS --annotation=platform=win --annotation=version=1.34.0.2808 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x7d4,0x7d8,0x7dc,0x748,0x7e0,0x7ff842efeaa0,0x7ff842efeab8,0x7ff842efead02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2804
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:4836
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e586782.rbs
- Size 7KB
- SHA256 e1bb9fd4156e8f25ec907e4a84b55e2007f193a8bd561fd38507d644baf16691
- MD5 e1f3901a4f0bf89a42ec065b7bb858a7
- SHA1 bff1f919e33d1f031d6789dfade5001b8d95edf7
- SHA512 cae07790ca2e5039897a96826ba9f2009273eaaefa39618fbec4c39e5d1e7007fb5f6da8ee1e0e4073ecd34b09728c1034f7acf749feb3b943f2fb879067d5f6
- SSDEEP 96:JmEFYHCZpqeS8Up4WszzCOTlJ4WszzCgjN1naBTl7a9B5cycf2j8rChpljhBOFgO:kEyHje8pbGuGXbGuDBMPBeWhpgH
- TLSH T1D3F12141A202C1DAF8A70B34CB4F1B263BB3E2E9A254638B59CCD5744F0778A1ED519F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\371983~1\x64\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll
- Size 21.8MB
- SHA256 c8f8a5b732e6169398ad87bab68a906dfca8c68f38e314a5b58ce318639f0087
- MD5 64a0c589c9e415d745a25d012392d265
- SHA1 17bdd1f200879fee1347ce4bcee77d1ca35dbc65
- SHA512 059413da9fd290d277b418feda23ef8ac5cbfbb5c1e94dcc92ed07b7b4e9bd105edcfc25b10a568f1192860da45c25b7f0d9d21871d12d27bbf42b47591e79e4
- SSDEEP 196608:POrKh6nE8gTUY7CuDuzCKFdu9CwJsv6tANNVYX1o:Pyi6nE8U5wCKFdu9CwJsv6tCNVYXC
- TLSH T14C377C17A3E91189E4BAD1B99B979A17EB7138050330A7DF02A067252E37EF45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe
- Size 826KB
- SHA256 f117f021c5b74a7eb3ba5a06ecb0fc2cabc4b81d2662857511e5046cabd4b442
- MD5 3ff86fe2eb651b8ecca9f005ce95e16e
- SHA1 5b9dbad9f37afaf332c868b210641e4cac9c788f
- SHA512 548b93aabcbaa1413a357d35d03d9272264dede2a61d6355f70447ec4b93c9b15eb7550b7dc6456f8d17b85b57d113220aa98e9502dafbabc4854f3786e621ab
- SSDEEP 24576:n6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji3M:n6gfPFPbZ3n8XQMOXTfIxzcZu0BMdma5
- TLSH T1C6056C5BB77801F9C177D138D643A907E6B6740B43B09BDB13A042AA2F13AD4AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe
- Size 541KB
- SHA256 916f68ef3c1d3c5c2d9ee07ec6f3723c3b0a8574fb829240035cd6fe09e852ad
- MD5 c62cb96c2251c84531efb3b976c28ae0
- SHA1 0bd587c213dea34846f9c73938bb5e3003874670
- SHA512 dc06920a1c95417107942300015a1fc8c955726fa6c22dd0915d165dfdad88719cb5610f0c5560e160f60943e390942b4ccbc2b12ad94608caf4a6248f2154f8
- SSDEEP 12288:/AnKaAawP0p1hqZiynTbc6Czv7Ii2+qifP4rXgAANUoau3L:yP4rXxANUK3L
- TLSH T1D9C48C59A39C03F4E167A13888865609E7B17C4613618ADF43F0A67A1F777F26E7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe
- Size 1.3MB
- SHA256 764d6b6236a255b8ebe062c9bf0934d36a38f082432521173eced5901066ae63
- MD5 a7dfa896c7cc1a88981191164d79a82b
- SHA1 34123ac13b00d15f3de56466aacc4ece1eff8435
- SHA512 ace281476fa67dfe7f7316325717596d4597732366b8c1e47a54937f0446712c0b752d9f9223f492e15dfda8aedc234391928f75e6a3b12a214c81b644f393b5
- SSDEEP 24576:tPJ9T605srQiAfXFOmesUvLTTQlxwF2UM6eXzbaOCFL2KFhH4z1:H97LiAfXFasUTTTuxA21X/aO4hH4Z
- TLSH T134558D1B62A841F8D0BFE17C8946890AE7B1780643729BEF13A8475A1F277E15F7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe
- Size 541KB
- SHA256 359b1c87aa3b2758b84d47ce39beb3c16fea9d64ebfcabd1d26173d196c03672
- MD5 6dc7893a149d214ed83a30ea9d78c1a3
- SHA1 38fb1b4e3fa05bd7a9980416ee5dc2b41d1beb7b
- SHA512 f5e1173ccbfe04e547e9f8f3d81d1684a50b91b7be71c17b79b8bc735748160fbe1a777addbf8f30f0812110174bf976502076ad2727a1ec0f622b07cf49c7e5
- SSDEEP 12288:36lnK0AawP0p1hqZiynTbc6qzv7oi2+aifP4rXgAAlcoHur:aP4rXxAlc/r
- TLSH T17EC48C59A39C43F4E167A13888864609E7B17C4613618ADF43F0A67A1F777F26E7E320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll
- Size 31.0MB
- SHA256 c5688d8f19dacae8a238b7ebc905c52cf97305a5fbf936160ee6c1a1af3dc231
- MD5 fe8f1124ef4de17a42ce280478f11a37
- SHA1 29b5faeebef1783ee96cabad92e16c9936fe79e3
- SHA512 8b5dbd537f071779c2925843f754d1c07004e9eb418dc1a06b10c7914a6b00cfdd6dbec4a98c207eeee5b74cc3feb8af482a4507f83feb08575f5c2bfb6a0f4a
- SSDEEP 393216:T79bpt07z7WkJGecBFv4U5lwDiJObRsy6ih/tGYCQW3KZ2KFdu9CwJsv6tlOVQsW:v9bpt0C/ONSU6wlCf3KZHVQL
- TLSH T16A678D17A2E500D8C0BAD0BCCB5B9A07EBB134451335A7EB15A496A92F73BF1593F321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll
- Size 16.0MB
- SHA256 3be143b5f77e1efd48cd8ef49dca413c7e94d08b9891d8aca82462daa0212131
- MD5 939400ca77fb84fa63cb77b7ae4678b6
- SHA1 c1ef8f39d54a7f7bd364776466ada1b60c43a8e3
- SHA512 03b16435d9b6bfb0c3499a8727236bc2ea4e64c9a62176b3fc21dab6b32ea3100170171d3df499f78ff25f220c850fffb9820b5ddbb06d1f76579fea8e13bcfb
- SSDEEP 98304:/TQWxTHR8PdsrpgoC2E4lNH9sEWVbGBnzmZFAQAinQ94CVIUZ478jX1OHzIdPr76:TxMIx9OwhFbr1HPr7i6AkCFtr
- TLSH T139078D0BE29251A8D40AC4B4876B9622FA24384E077575EF27D59BA43F77BD07B39F00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll
- Size 3.5MB
- SHA256 1ec0eb21e7c355668d648e0450b2cfdff4d9d938b841d5f173e98a467794fa17
- MD5 a76dc39f89c73558ac3a38871f0f888d
- SHA1 44eef2dcbd6e11c6a8fc88205d024d76f1df27b5
- SHA512 7ff22af7fed936372789548851f86c8affeb770808d45339d7859b37c3654859e311b7540ff01aea7759e3510a98cf084177e6fb498702e1927c7316984b058d
- SSDEEP 49152:8GtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvm4:8S+ZC+b65hmMorxeNNn
- TLSH T1FBF59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log
- Size 7KB
- SHA256 0f08f818f628930e3947e5d920ce15319635cd0c0b97067b881c7832bef44921
- MD5 1d105308caae71496747d88ae74d2108
- SHA1 e1f3f462849174a1594fe87835cf8421111dbb03
- SHA512 6b7cfda916be0ea4a2524e7f19fb6cfd2fccd65b737510126a41f4484e8c38b78ee0b63697ed976c7757eddcd40e7d6982c39221809f4115443ed5eb38460acd
- SSDEEP 96:oLxSDTNMGBrEz/Xjw3EzHMiH5H2fZ4CtSZQDdxvfc0fgsmUz/Xjw3EzHMiH5H2fb:PBIzvjxzHMaHVq/tHLzvjxzHMaH5u
- TLSH T19AF133CA0C653CF727217A69EF860ACE81F134599EB468A19BCD791607CFF172393128
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll
- Size 7.6MB
- SHA256 6541cfbeb8241246d979468fcce5ca55bc43824caf1e1838b53ba096f04fbfd1
- MD5 4ece000e3dfd7eee5f83e11043188e37
- SHA1 531fdee73f171c29bb7d2e61a1d2f501b3a6da73
- SHA512 add498010a9a72f4f4dd3be2011d84bca130bcc7a6a3ff9ad0b1152f5ffea4fc66a80bf226b27ffc9de780aa1047184f7e2077370170ae7ae70e0fc965bd50bb
- SSDEEP 196608:9HKMxeJkZ3KaUUQxKfNr3Y1CPwDvt3uFA0C5:9HKMxew3KaUUQxKfNbY1CPwDvt3uF3C5
- TLSH T1C8867BADA6BC0109E4BA82BDC2875627D371B91913B053CF596186F80F23FD92B7E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll
- Size 1.9MB
- SHA256 0d50c3c0a0c653a1cab449a8782c1bb16f95e3ee2b118a37d845d8e400cfcc44
- MD5 9675e9736d8a103581db4625d2d37545
- SHA1 bced267e564ec023cf4e875e3bbdfcced1272fe8
- SHA512 0b15d92cb4d3744068d703f51b9a88956f7a70dba1dc46b57d070b2a5111f5b4fdfae4ed97d8a3c64c199396ca99a27506cf4ca295ebdc56f11390d9c98ab183
- SSDEEP 24576:sqosXnpedGDDhku5dVozD+EmSf6Jca14kfaPsPRg5aYs1:sqounpedG5B8+EFVxARg5aYs1
- TLSH T11D957C5AA7B81199E4F7D13CC6478B17D6B2B81A1370A7CF06A086B91F23BD51B3E740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json
- Size 1KB
- SHA256 7a75625ae5a4dae202b7cfadc2c607ff4505090c1572359eb04b322efafacd27
- MD5 cc5a0a24c7bde5f8dd2c8247134793c9
- SHA1 80fe58e6c5a90be9b5f27d6fd621d1ad34dc4c1a
- SHA512 cc1eba04b8ea72bc947d5147edcdfe9aa2029e65087325ccf3dfcc68a1c174485aa642f48907282a485670b1b559d6c9024722d1bf521075442d0a1820da9106
- TLSH T1BA21DFD1C9516D2B7725A4E48D252B862271017B5D9434E6BB8C1A1E0F8FF2F21B327D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 699B
- SHA256 736b8a278142ed89216839835cb5690d32bb1e9f7f3bfd87ec3ffb5fd60fc47b
- MD5 b2124786386164f5b5d3c87b15bbda05
- SHA1 2ac49c21ecea6606a8208da65a148610520647ee
- SHA512 e821c4d1dfc7482031327d0747fb8c7a39c2e2c26844ddd0cf533384e11db80ccd9aa617dcd86cc9bfe613375b7f0af9ce0c292d78002c548d3a346861086bd3
- TLSH T16A01FCE50EF621394713BDD8CD5E645EE1A64C5115C9BCE29A0D2E2A04D3FA37147474
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 800B
- SHA256 436ec0a5d7de3371fb91cdffea49f8dfe746f869698b52bdeeec4497f048bd50
- MD5 1de7b3b06d3176f8d3096e3398d8c368
- SHA1 6799dfd208e7b32a5100bbc4b827fd2c6dcd3eb8
- SHA512 1729cf8292cdbff84d9dcb93aee7ceb1b9730b43e8a55031a1a948b2ed8b32145b9a08bf40c7d7a87516cfa3d389f124a0d1de3d90a0a12c480d81265e7af4e1
- TLSH T1DC012BA1CCA11E374711A9C4CC15244EB21549671C84B8E67B0D1A1D0F9FE6F32B353C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 1KB
- SHA256 df4ca31aaa5f697e1de89f27d835a85b33cd4848bac55963d649ff9d6117acb9
- MD5 18fd8e3166560956f403041250e71b63
- SHA1 9e0d28c97984adbdd5c0b3211ffd3fdf63e49341
- SHA512 69ce8f5c87d000ebf6fb60ed6910dc878a7572b4bcd367a54a2ae54eb3c4c71b539d95a0c82399c493a7426bb427ccc39b0e9455ac692007ab78743ca51a028e
- TLSH T19F11BBE1CC511D771701A9D49C19268A722289A71C54B8E6BB4C0A2E0FCFE6F31B313C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
- Size 33.8MB
- SHA256 630cfa0708e6edcffa9952011aae63fca1725f63ce99e03027d40c341e6b399d
- MD5 2a42521da20ad4b97d1c27eff104c71d
- SHA1 117a4490f27ac7641c1981dd0c6acead14ba6498
- SHA512 0c7a96e7277889403ae4ce176bd8fea3a8cd5a0263274e2bb1332dc7d88592258d4c6a3bf63d4d6b5a092454cec3ca28ec702e13d0470a7acd9d91a3f9057ac9
- SSDEEP 786432:4jSrJrQGRfAQPtLXuCAopuNMo3XG9cf9yqNWLP761Tp:4jgRoQPtoZMo3XazqNWr7Ot
- TLSH T1F0771217A3EA01E4D5BAC078CA679547EBB2780503306BDF12A4A65A6F73AF05D3F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 56KB
- SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
- MD5 752a1f26b18748311b691c7d8fc20633
- SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
- SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
- SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
- TLSH T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 64KB
- SHA256 75cdf9ec20470a5f0cd8e011a5d0c4a522f9737a8d23edeed5ca7e5c2605e9eb
- MD5 fad9e398e03653e46493d9bb225ce3d8
- SHA1 daf49c600358e001377dda32f48cdfce03156023
- SHA512 7bec2af7855f02618b028b450e5a2a55c8fed5b62e48be2334953c1108d3cd356ccebcda73d449cb8085bbafb48af2b7d306d0f1beeef9bf1f73556c7a01276c
- SSDEEP 384:yeKdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:5+eUZsLQCZsL3hUS4
- TLSH T13A53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI6C23.tmp
- Size 5.7MB
- SHA256 02556416296233c259d4274cbd21786c4931ef81c42f0ea85f7609ee61003556
- MD5 bb33b6abdb4b65b0642f0e21406f02bf
- SHA1 01a0dcb80c9d7ae48768e8677cc50eead8537757
- SHA512 cd78568e95565c5c570a2e5a22792f1b2844b532079efbe25056e0b49c24a89cef0acf6c3d92e392059499a1272be7b3b0868a968e8f8e8b28ef638564a20341
- SSDEEP 49152:r+oJ9uY5R7iSvKJYMuUVCJv9cDttTqZBQlhCMrjidNetmAz+hXuUKW0n+ZFFpSfC:holjVFfoemIKFdu9CwJsv6tp8P
- TLSH T1DC568D1BA2E60154D9BAD078CA6B9547FB723C0613306BDF02A4A6166F73BF05A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58677f.msi
- Size 35.6MB
- SHA256 29906168eba271442305389aebe91a5091ae933d551101ad60087f699ca2630f
- MD5 ab7e7ff9fc24a0b1f8ad7863c4a0a2ec
- SHA1 96f043a70e69af7759e92b60dadf507e906bc2c0
- SHA512 10ba657c9baf30cc7e5a2f2339c5398687b1de74e98a823ea5fe3f2eb857683a15b9f9b61f727aa9e2760bccb16f826183e4a26820b4e96e7f2d5f3033ddf99e
- SSDEEP 786432:yPY1Az3ATtecG06QsFodGzrzzsEwN+4PphXiIgvWoE:yPfUTEcG0vKzzsEgjhXi3vz
- TLSH T133872217A2E601A4D9BAC078CA6B9657EB723C06133067DF12A4B2556F73BF05A3F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{55b8f837-95bf-ab42-960a-431580cfe87e}\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 14fc4a36941bb2e4fc1ba2e1f4941ed7f4dc3ff71db504f5c57e35e71fee0e4f
- MD5 01ba6db664825c80c61aa7ffd5b1b0aa
- SHA1 288279294b014366e6ab2e320a929dfe087f5d46
- SHA512 a30cfc8282a67606921da58931bde85f4855a41d08634ff37a9f4fc98a849f4fc6c04fe74913fcddd0c13b458882ad273e48b626b619a4b7fef7442e9d99fd73
- TLSH T1C001108339AB19B03A8C45B8CD84929DA0E764582ECB1E9AD43524CCD467627BEB3015
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 727B
- SHA256 69cad82266bfddce643a6c2f6b909e66ca584e262e386baf7cac191b590e3e7b
- MD5 4d499bc7c90c822986626d7c897f3e4e
- SHA1 06a61a84fd1be62166fa7139655310f1f535fe1c
- SHA512 6c928ede4eb78c96107f7f0e04afb283a652ad734d1e3d888390db74c1731cec598dd3ef6e547b6e7e6648c5ce6bce69bdf98977ea3879a079f914167e0615de
- TLSH T108011503AB6A8E801B5C8D558FE2B665BED5023446E8554F516715847B876721602A60
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 5536b5be6a0e956aaa72a5563e06fd127d08e7a06f5352cc64eb95d551750e3e
- MD5 08ef8d3d1890814027c9ca3c94d1a98b
- SHA1 f1328affc6c773c7776424002c27ecd897387433
- SHA512 e28186d69ff718a0f8e5355526b01fc094a0afa410f361bfdc32d7fa6aea3553d023040466402c4b82e02751a1ae467bcf9355c3068bd5380802708af8926f29
- TLSH T1BCE0C0161DF1012DF3A7CA799FC275524C09F1939C008BA40FA0054CCA4CB000D928F4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 408B
- SHA256 b3cd1d2864cd7fb811baf9dff3229286c43599adff68b9f16a8fe2316398112f
- MD5 926be0ec27c48c941a03616ad4906fd7
- SHA1 91f8b411c27b2f3f5ada3b1a90ffcccd3dd1c789
- SHA512 76910d9e257fbcecf158c0f9fd679dfc01af67260e886a4e8ff88059d518d94c1e0a865783f116462817cad2897e0f5ac178f070cbafb2af9b7923a3da5265d5
- TLSH T18CE0C03471FD148DF1F4E4B482F75911784EF2263441C2650D809345AA24F401CE1225
- MD5 SHA1 SHA512 TLSH