Overview
overview
7Static
static
1RR2401/83453171.pdf
windows10-2004-x64
3RR2401/83453171.pdf
windows11-ltsc_2024-x64
3RR2401/Log...ed.msi
windows10-2004-x64
7RR2401/Log...ed.msi
windows11-ltsc_2024-x64
7RR2401/install.vbs
windows10-2004-x64
7RR2401/install.vbs
windows11-ltsc_2024-x64
7SWIFT_MT10...93.vbs
windows10-2004-x64
5SWIFT_MT10...93.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...74.vbs
windows10-2004-x64
5SWIFT_MT10...74.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...71.vbs
windows10-2004-x64
5SWIFT_MT10...71.vbs
windows11-ltsc_2024-x64
5SWIFT_MT10...12.vbs
windows10-2004-x64
5SWIFT_MT10...12.vbs
windows11-ltsc_2024-x64
5Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 14:20
Static task
static1
Behavioral task
behavioral1
Sample
RR2401/83453171.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
RR2401/83453171.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
RR2401/LogMeInResolve_Unattended.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
RR2401/LogMeInResolve_Unattended.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
RR2401/install.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral6
Sample
RR2401/install.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
28 signatures
150 seconds
Behavioral task
behavioral7
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_33230393.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SWIFT_MT103_PAYMENT_01.pdf __SWIFT_EXP_33230393.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_68644274.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
SWIFT_MT103_PAYMENT_02.pdf _SWIFT_EX_68644274.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_83453171.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
SWIFT_MT103_PAYMENT_03.pdf _SWIFT_EX_83453171.vbs
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
SWIFT_MT103_PAYMENT_04.pdf _13295212.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
SWIFT_MT103_PAYMENT_04.pdf _13295212.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target RR2401/install.vbs
- Size 7KB
- Sample260730-rnwtwatvb1
- SHA256 66cd2d2a533b9ac820fd8c760e8390274e02ca0c96c3646786383102f2b76545
- MD5 d2567038bfcd724a1992159cba3f6f55
- SHA1 79a2f57da31229293cbdbccd1eae0a67751e472e
- SHA512 d6d14d98d34f97c839a4c4400092a1ed29fd626a49df52565007bbb2cbe9d31176302f7c091cfaa8efae23f7501e65374019806650e21f86f876287c5de6ae6d
- SSDEEP 192:c1O5A2wy8J5HNBo2V+KvE+lKyFVrNPT+82OuTa4SfqPwY:cuA1bBa2MKvEYKyFVrNPT+1OmIY
- TLSH T1EDF19257BEA3433096D384A891AA0C2D96E6D727506B4492FFDC48941F18BFD93F08D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation WScript.exe - Executes dropped EXE 7 IoCs
pid Process 2456 unattended-updater.exe 2704 GoToResolveUnattended.exe 3748 GoToResolveTools64.exe 5048 GoToResolveCrashHandler.exe 2352 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 1332 GoToResolveCrashHandler.exe - GoToResolve remote administration tool 1 IoCs
GoToResolve is a remote administration tool that can be used as a backdoor
resource yara_rule behavioral5/files/0x0007000000024567-29.dat rat_gotoresolve - Loads dropped DLL 21 IoCs
pid Process 1140 MsiExec.exe 1140 MsiExec.exe 3748 GoToResolveTools64.exe 2704 GoToResolveUnattended.exe 2704 GoToResolveUnattended.exe 2704 GoToResolveUnattended.exe 2704 GoToResolveUnattended.exe 2704 GoToResolveUnattended.exe 2704 GoToResolveUnattended.exe 2352 GoToResolveProcessChecker.exe 2352 GoToResolveProcessChecker.exe 2352 GoToResolveProcessChecker.exe 2352 GoToResolveProcessChecker.exe 2352 GoToResolveProcessChecker.exe 2352 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 5 3848 msiexec.exe 7 3848 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GoToResolveTools64.exe - Drops file in System32 directory 26 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_c7a5777273c98ebf\displayoverride.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\SET4F93.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\SET4F94.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\g2rvdd.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A GoToResolveUnattended.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\g2rvdd.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\g2rvdd.inf_amd64_5e96164a846f7842\g2rvdd.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c} DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645 GoToResolveUnattended.exe File created C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\c_display.PNF GoToResolveTools64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\SET4F82.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddmdx11.inf_amd64_e8336336d081cc11\rdvgwddmdx11.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\wvmbusvideo.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\virtualdisplayadapter.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\rdpidd.PNF GoToResolveTools64.exe File created C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\SET4F82.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\SET4F93.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\g2rvdd.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\SET4F94.tmp DrvInst.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 1544 WScript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.cat unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\openssl-openssl.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\legacy.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIInputHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM32.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json.tmp GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveNetworkChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIFilterHook64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\microsoft-gsl.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattendedRemover.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x32.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTerminal.exe unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\settings.dat GoToResolveTools64.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log GoToResolveProcessChecker.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveServiceManager.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveEventViewer.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupportM64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveService.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnlock64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\WebRTC.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveTools64.log GoToResolveTools64.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveUnattended.log GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRemoteControl.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveRegistryEditor.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\Thalhammer-jwt-cpp.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp GoToResolveUnattended.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\settings.dat GoToResolveProcessChecker.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMISupport7x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveQuickView.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveLoggerProcess.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\google-flatbuffers.txt unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveExternalModuleHandler.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\gabime-spdlog.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe msiexec.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json.tmp unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x86\g2rvdd.inf unattended-updater.exe File opened for modification C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB\metadata GoToResolveCrashHandler.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattendedUi.exe unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.cat unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\libjingle.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\licenses\chromium-crashpad.txt unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json unattended-updater.exe File created C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LMIscrhook64.dll unattended-updater.exe - Drops file in Windows directory 17 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI1EFE.tmp msiexec.exe File created C:\Windows\Installer\e581646.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log GoToResolveTools64.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\Installer\e581642.msi msiexec.exe File created C:\Windows\Installer\SourceHash{323BFC02-FFF5-428A-A831-696BD6812855} msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI21ED.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\e581642.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI1B24.tmp msiexec.exe File created C:\Windows\Installer\{323BFC02-FFF5-428A-A831-696BD6812855}\ProductIcon msiexec.exe File opened for modification C:\Windows\Installer\{323BFC02-FFF5-428A-A831-696BD6812855}\ProductIcon msiexec.exe - Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3984 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1908 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe - Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GoToResolveTools64.exe - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveUnattended.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveProcessChecker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GoToResolveTools64.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GoToResolveTools64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveUnattended.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GoToResolveProcessChecker.exe - Delays execution with timeout.exe 2 IoCs
pid Process 2056 timeout.exe 2628 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveUnattended.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs GoToResolveUnattended.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates GoToResolveUnattended.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot GoToResolveProcessChecker.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates GoToResolveProcessChecker.exe - Modifies registry class 25 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\RR2401\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\PackageCode = "2FF0721D5660CD749B83F35AC1129B18" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings WScript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\PackageName = "LogMeInResolve_Unattended.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RR2401\\\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\ProductName = "LogMeIn Resolve Endpoint" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Language = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\ProductIcon = "C:\\Windows\\Installer\\{323BFC02-FFF5-428A-A831-696BD6812855}\\ProductIcon" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\8871D70D11E7F0045A59C535B4C34718\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RR2401\\\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\20CFB3235FFFA8248A1396B66D188255\ProductFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\Version = "19070977" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\20CFB3235FFFA8248A1396B66D188255\AdvertiseFlags = "388" msiexec.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3848 msiexec.exe 3848 msiexec.exe 2456 unattended-updater.exe 2456 unattended-updater.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 4716 GoToResolveProcessChecker.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3324 msiexec.exe Token: SeIncreaseQuotaPrivilege 3324 msiexec.exe Token: SeSecurityPrivilege 3848 msiexec.exe Token: SeCreateTokenPrivilege 3324 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3324 msiexec.exe Token: SeLockMemoryPrivilege 3324 msiexec.exe Token: SeIncreaseQuotaPrivilege 3324 msiexec.exe Token: SeMachineAccountPrivilege 3324 msiexec.exe Token: SeTcbPrivilege 3324 msiexec.exe Token: SeSecurityPrivilege 3324 msiexec.exe Token: SeTakeOwnershipPrivilege 3324 msiexec.exe Token: SeLoadDriverPrivilege 3324 msiexec.exe Token: SeSystemProfilePrivilege 3324 msiexec.exe Token: SeSystemtimePrivilege 3324 msiexec.exe Token: SeProfSingleProcessPrivilege 3324 msiexec.exe Token: SeIncBasePriorityPrivilege 3324 msiexec.exe Token: SeCreatePagefilePrivilege 3324 msiexec.exe Token: SeCreatePermanentPrivilege 3324 msiexec.exe Token: SeBackupPrivilege 3324 msiexec.exe Token: SeRestorePrivilege 3324 msiexec.exe Token: SeShutdownPrivilege 3324 msiexec.exe Token: SeDebugPrivilege 3324 msiexec.exe Token: SeAuditPrivilege 3324 msiexec.exe Token: SeSystemEnvironmentPrivilege 3324 msiexec.exe Token: SeChangeNotifyPrivilege 3324 msiexec.exe Token: SeRemoteShutdownPrivilege 3324 msiexec.exe Token: SeUndockPrivilege 3324 msiexec.exe Token: SeSyncAgentPrivilege 3324 msiexec.exe Token: SeEnableDelegationPrivilege 3324 msiexec.exe Token: SeManageVolumePrivilege 3324 msiexec.exe Token: SeImpersonatePrivilege 3324 msiexec.exe Token: SeCreateGlobalPrivilege 3324 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe Token: SeRestorePrivilege 3848 msiexec.exe Token: SeTakeOwnershipPrivilege 3848 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3892 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe 3892 AcroRd32.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1544 wrote to memory of 3324 1544 WScript.exe 86 PID 3848 wrote to memory of 1140 3848 msiexec.exe 89 PID 3848 wrote to memory of 2456 3848 msiexec.exe 90 PID 2456 wrote to memory of 2704 2456 unattended-updater.exe 91 PID 2456 wrote to memory of 3748 2456 unattended-updater.exe 92 PID 2456 wrote to memory of 1908 2456 unattended-updater.exe 93 PID 3748 wrote to memory of 5048 3748 GoToResolveTools64.exe 95 PID 1544 wrote to memory of 3892 1544 WScript.exe 96 PID 1908 wrote to memory of 2056 1908 cmd.exe 97 PID 760 wrote to memory of 3024 760 svchost.exe 99 PID 1908 wrote to memory of 2628 1908 cmd.exe 100 PID 2704 wrote to memory of 2352 2704 GoToResolveUnattended.exe 102 PID 3892 wrote to memory of 3200 3892 AcroRd32.exe 103 PID 3200 wrote to memory of 4320 3200 RdrCEF.exe 107 PID 3200 wrote to memory of 4320 3200 RdrCEF.exe 107 PID 3200 wrote to memory of 2124 3200 RdrCEF.exe 108 PID 3200 wrote to memory of 4332 3200 RdrCEF.exe 112 PID 3200 wrote to memory of 4332 3200 RdrCEF.exe 112 PID 3200 wrote to memory of 1556 3200 RdrCEF.exe 113 PID 3200 wrote to memory of 4724 3200 RdrCEF.exe 114 PID 4716 wrote to memory of 1332 4716 GoToResolveProcessChecker.exe 115 PID 3200 wrote to memory of 4252 3200 RdrCEF.exe 119 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RR2401\install.vbs"1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RR2401\\LogMeInResolve_Unattended.msi" /quiet /norestart2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RR2401\83453171.pdf"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=12BDD0330DCCA67217AE367476295C0A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=12BDD0330DCCA67217AE367476295C0A --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4320
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C8612BE50B2C6D80CD72E9AEA76F1B88 --mojo-platform-channel-handle=1980 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2124
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4E3DD138BDEA70085B7C7408D16278B2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4E3DD138BDEA70085B7C7408D16278B2 --renderer-client-id=4 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:4332
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B8ED9E149ACD08C5E1EAF9694EA651CB --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1556
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB8E59F3EBD52D4FE7C268A495268D31 --mojo-platform-channel-handle=1996 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4724
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=06FB951265CFEC56C6431E63162F6281 --mojo-platform-channel-handle=2600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4252
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding CDA497B2334FB685F82C8FA91D9189482⤵
- Loads dropped DLL
PID:1140
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe"C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe" -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\RR2401\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{323BFC02-FFF5-428A-A831-696BD6812855}" "-MsiUiLevel" "2"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe" -regsvc -regsvc "-MsiInstallerPath" "C:\Users\Admin\AppData\Local\Temp\RR2401\\LogMeInResolve_Unattended.msi" "-MsiInstanceGuid" "{323BFC02-FFF5-428A-A831-696BD6812855}" "-MsiUiLevel" "2" "-installerFileName" "LogMeInResolve_Unattended.msi"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 2704 -InstallationId baOuDccoR0 -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType 4 -Environment "Production" -ForceInstall 04⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:2352
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe" -InstallVDD3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=component=Unattended --annotation=computerid=51d9e6f0662231ee8c9ff9e2b0698244 --annotation=format=minidump --annotation=hostname=Tigmgolm --annotation=platform=win --annotation=version=1.35.1.3628 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x3ac,0x3b0,0x3b4,0x3a0,0x3b8,0x7ff73f4f04e0,0x7ff73f4f04f8,0x7ff73f4f05104⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5048
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /S /C ""C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd" "C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:2056
-
-
C:\Windows\system32\timeout.exetimeout /T 34⤵
- Delays execution with timeout.exe
PID:2628
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf" "9" "4e1e440a3" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3024
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989" -ApplicationType "4"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=companyid=3719837408790104989 --annotation=component=Unattended --annotation=computerid=51d9e6f0662231ee8c9ff9e2b0698244 --annotation=format=minidump --annotation=hostname=Tigmgolm --annotation=installationid=baOuDccoR0 --annotation=platform=win --annotation=version=1.35.1.3628 "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\params.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\pc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\ui.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\logger.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\leavebehind.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\rc.json" "--attachment=C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\externalmodulehandler.json" --initial-client-data=0x7d4,0x7d8,0x7dc,0x748,0x7e0,0x7ffb15fed0a0,0x7ffb15fed0b8,0x7ffb15fed0d02⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1332
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe1⤵
- Launches sc.exe
PID:3984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e581645.rbs
- Size 7KB
- SHA256 ee168f80cea6253cefc631ce4945fb22abb578597e5190a8d55321d5893a8902
- MD5 571e371a0fefa9188ad453b61303ac91
- SHA1 e50d1dfe940f6c1cf5f61f3a29818e5cd1d06d2c
- SHA512 3244678bc064cc18a61c5bf39504a553c4cb890d1662d1ee27be5d81b84df8c0813943c2feae84e4eb5f7c8ee0f1287b2752e5b4c6fab32d44c1d5471105191d
- SSDEEP 96:pm2tKJCZpqeCPQ7Wsmd2COTlxWsmd2Cgjt5zaBTl9a9x5wyijKHw5Cqplj9SOFPl:E2QJje9anlG2nl/BazBscqpbH
- TLSH T186F133812B0A51E3E9972B39D31717583B72E3989351230B09CE90386E57FC51F982BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~2\GOTORE~1\371983~1\x64\g2rvdd.dll
- Size 141KB
- SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
- MD5 e00f914a13981678cc130f7c65807f03
- SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
- SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
- SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
- TLSH T18DE37D5B77A404BBE5724534C4A34A06E7B1B8521B71CBEF03A4826A1F277D19E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\FileManager.dll
- Size 21.8MB
- SHA256 20cd98d5a5bedea833d1c20b7ce2fe665fdc2c740629324a4fc2585cd01a5c3a
- MD5 0b375ad0157c3eead2199bf5565938a1
- SHA1 a368cfc599abf914bb66c743c5e593d91a14a905
- SHA512 0b495ab3b748f2a47107c053487d9296ff9d5d2d368e38fb2f1581fc3eec342b1a46e8a622b91c07113e7f7a23a9bb766e44968889a8ac0986f14360f6b0b5bc
- SSDEEP 196608:8OrKh6nE8gTUY7CuDuzCKFdu9CwJsv6tANNVYX1k:8yi6nE8U5wCKFdu9CwJsv6tCNVYXi
- TLSH T1DD377C17A3E91189E4BAD1B99B979A17EB7138050330A7DF02A067252E37EF45F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveCrashHandler.exe
- Size 826KB
- SHA256 cd5ada0836e9e4466ff525dbf972cf29de2690b61cc9ce7ebf550e2ce06b5a17
- MD5 42314c843984d071d72dc54b2c769cb3
- SHA1 adeeb591a11e12d8ecc68d2a73bdd58bcc7cc251
- SHA512 b5b204c85de66307cddfc99f9950c07993250618ee168580fec06b8a3a69a92d3af53d52e5a16c70a8650eed6de7b8d0b0c5da20d86b698daad746cd7d2dcf11
- SSDEEP 24576:/6gfeOFPFhDqEPvn8XQMOXTfIxzcZu0BMdmaDji3y:/6gfPFPbZ3n8XQMOXTfIxzcZu0BMdmaP
- TLSH T10D056C5BB77801F9C177D138D643A907E6B6740B43B09ADB13A043AA2F13AD4AE7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveProcessChecker.exe
- Size 507KB
- SHA256 24f7e0c91b7b521f3321938c8986f33f3c3ee2946e378247572823e882ec15ec
- MD5 ae023ee79a3ea796b4b53fb4b79f4260
- SHA1 b1f61e3ce7c6e4288289835a829a9962dd2b7fe5
- SHA512 11df906b40e49e8f4f6dcd60c3d953bd9a8b0ec98386b4fee2a54fcbd05dabcebebe34f40fc1a8a1603381985d9e3342a39d4100b2a5cfd9f7e965ae256a3246
- SSDEEP 6144:wfParRr/K3cCXAzucWHF5HKIFnWmfug+PU4QvLd7TaPq9/ZZ/xHl+ka:ePIyX/8INjd+PcK69xHLa
- TLSH T168B48D19A29841F9F16BE138C9424906E7B2BC051361D7CF43E4BAB66F736E05E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveTools64.exe
- Size 5.9MB
- SHA256 356e761c251a98e8a0af5ad2c4bad44ab3b9e252c3d268397171fe17a44ecd1f
- MD5 2c1a898bb8acdaab4796757cc668d48e
- SHA1 6d16d667474822ec0b2ee4827144e3546610bacb
- SHA512 48c99339f94cdb539bcb4c562c3f90a0b085d87054133cd11e601947336b95f439be16d21d7708f4cd75e68de09882b4f322c82f977d853d41b52a5053b1b7fa
- SSDEEP 49152:Lw5aohMFAdaHprhYIzBZ03lICHAnK0ChBaBT6W09tOvF149dliWNCMOhYWdV1SNZ:LUaUw6gCUFRS3KFdu9CwJsv6tusNB
- TLSH T119567C17A2E60194D9BAD078CA679547FB727C0613306BDF02A0A2566F73AF01E7F325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\GoToResolveUnattended.exe
- Size 507KB
- SHA256 11637654df7de141c9de1116a173551e7da1c3733fe9067bcd040e38ddd16863
- MD5 de2e7785c1e0151d69a888ed8c5696dc
- SHA1 7eb58839351ab1b045d0ffc62db7f1e8e97b0ec3
- SHA512 5caaa1f4a2c3cc8b00cdca42a74689c90ef56061eff2fb4e87d32f19e3842312e6c38a1a2c7ca9363ae834e22e70cc74453651e4fb29be481ae732c5d281be59
- SSDEEP 6144:T7Ha7RI0KXcyXzjucWHF5HyIFnWmfuQ+PIOXvLd7TyrjOqW/3hNl+k:PH6iXO0INj9+PB28/3XL
- TLSH T10DB47D19A29841F9F16AE139C9434906E7B2BC051360D7CF43E4BAB62F736E05E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\LibGoToResolve.dll
- Size 32.1MB
- SHA256 b15588151ccf2d07516ee19d957718ce3e068b408c17c63fda93f5edd6e2fa86
- MD5 e524f49f427d2be159246456d7b31d2d
- SHA1 bfec33ebcea2655d1b82b8e3032847c0140d1b81
- SHA512 ae7d237bc6f8502703fd95833c8b64cb810f241fd546f0af620ecbcdcf8b33e5a3f842fc7e75d71ccd2d84a2762970593c09b7b36b504b918864445690e82214
- SSDEEP 393216:qElh/Awgyaq4ZxCyb1Etcc8BOKycRC0YCQW3KRJKFdu9CwJsv6thBI5:pay1yfhyPCf3KRPI5
- TLSH T108778C07A1FA05D8C1B6E0BCEA679907FBB1340513356BEB05A882B52F63BE1593F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\MediaClientLib.dll
- Size 19.1MB
- SHA256 7bb0b7e3c14c894ee616d7ea8a6c116980b6d60d3c92694c5a7d1219295203ea
- MD5 de032df65adf5b44fe98c0599db7d082
- SHA1 41fccab2887234b1bba1502f78a30fed60cc9183
- SHA512 28e91b73595ecb717cac0f902b9de006e3e82cd28ff60de022fa6dccf78360274733df7d7536c0c803714b1ce397e1ad72e5c50043693a2eb10a12665b51569d
- SSDEEP 393216:dJ2WV0i6tBoTFcma5bWSqT1sz6DxYLa1y5aLdbM/eO3Gg:2mCN3Gg
- TLSH T1C7178E4BE29250F8D45BD474975BAA22FA24384E472469EB17D08B703E73BE07B39F50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\PasswordPrivacyDll.dll
- Size 3.5MB
- SHA256 2e365cdef412cc390835cd4c61c20f0e440d5905e538085b9d51310f1b9ca005
- MD5 189b1106d32bf5e9a68bcc3f908311bf
- SHA1 1976fb83a614ef8a1638589d1f6d8bf2eb303e25
- SHA512 531a7ccd3f642df626ea0c52f99aff98ed05641f01db1eb4f521b195892b4ab56204882c88c3ea88f31753ade20958ebf3c4df0e2123e0dea49ad303bc7eb7d8
- SSDEEP 49152:BGtlqBqVwASOw1IU6ixVpRX022oAEvah3V2B1+XT5sEezEhmZrNA3TMwiBcSGvmf:PS+ZC+b65hmMorxeNNg
- TLSH T1C4F59E19B7A800A9D47AC23CC9574627D7B2B8135770DBCF066596AA0F33BE2573EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\appdata\GoToResolveProcessChecker.log
- Size 7KB
- SHA256 c84bf9487296e0891ad38fd67cd4be125f1b04ac9a7ce558bddb3e0aef6e4ba2
- MD5 20b2fe18a0c8e802587fb6d3fef76646
- SHA1 dbefa00283e239f3f0bf39c1bbc94286c4f752d0
- SHA512 a185abe2b095d265efdaeb18415ab335dd7af61b8f8a53e909fe35d42e413f3f8b8b4a75c4fb550af06f32bbb77ab7499c6f9dfe954501c9a841f52e70f4fd18
- SSDEEP 96:oi9r7/XCiwLHVHf92fz2wf61U/XCiwLHVHf92ft:tPvCiKHjo2wRvCiKHjo
- TLSH T1C0F100CA09693CF72366B625EE8A1ADE91F1245D4CE864B197CD742706CFF1A37A3024
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libcrypto-3-x64.dll
- Size 7.6MB
- SHA256 74e3692327b1abea5677f988055c2e7d729f4379f86f8050a47a2469b84bedc6
- MD5 ec1d4b202d12844b64bd059f00cfce72
- SHA1 279d010ed1b2c82dda3d0db5dcbb62d03c5a9e65
- SHA512 5500fb42e465ce718e33d5b4b69b508dbff62caa9a148e621fa500d032f3b2956c746718d02c6fa90c23e1a3e233a896395d3acac40ff8bb5263882521e9bd77
- SSDEEP 196608:S3ETkrsM90J73luZRReAoh1CPwDvt3uFA0Cv:S3ETkrsM90l3luZR0Dh1CPwDvt3uF3Cv
- TLSH T119867B6DA6BC0149E8BA82BDC2875627D771B91907B013CF196196F80F23FD92B3E741
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\libssl-3-x64.dll
- Size 1.9MB
- SHA256 ae8980a3d38dcb847d8ab544f344028268ea42602ba5c4dcd4706828022b2280
- MD5 12ef49f3d71a1b606a1b8b28fcd586b8
- SHA1 3b882419990319263e877b413165e2c704fe9575
- SHA512 ae9830ca8ae86ffd1caee068db6b86e4872c4d96d0be0101fd2c25157843b9a91519bde9868447908504aef51a3f108077eda6c05fd3d5643513ef8940a41560
- SSDEEP 24576:psETwcxJHIqeZDxTNZiQtdwCKlDABwZeVp4r2WTLHghrRg5aYsK:uETwcxJHIqiNZ7rKlD0RrRg5aYsK
- TLSH T1B0957C5AA7B81199E4F7D13CC6478B17D6B2B8192370A7CF06A086B91F23BD9173E344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\mandatory.json
- Size 1KB
- SHA256 a0fb554b7b58cbc4cc1490bc645c69d18502e6fba46ea907d19aeab508e211aa
- MD5 14114cc029f421de579c650203422b8d
- SHA1 ed68666448f9f49a9e46fc4d677b08bb9fb10d6c
- SHA512 9897e57ab28d91dfebf7aa420dfdb9649d05554b3ae63368a9942e99a1e11a613113937071fb96ada41c08a3f54c6e72f435d394155ef734549b5d5b2d01845d
- TLSH T18B21EDD0C9562D7B2705A9A89D352B862271007B5DD830A6BB8D191E0F4FE6F22B317D
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 699B
- SHA256 7c2bdcd023ef2fb0b87dde5b93af983a4f0a91937b94076557d7ff7ce907052a
- MD5 e313b0c3b67285c850787557e93afcd5
- SHA1 73465defdedf030767487d0e6bb3b7d17c7d690d
- SHA512 2e4b482f6422ad8886d49bd15604042655bd816db50c843b72c27ad947774dd85b44e81a6c1a82bcaa521104cb3e8e67a441296374df6b7b9f26e20ad26991b1
- TLSH T1E70170E60EF6357907037ED8CC5E645EE1A5486224C8A8E3AD0D2E1A1493FA72187478
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 800B
- SHA256 2a1b87b934b7c7ae93dfa7c5ac6cd9f3cbf40fca0b4418435e9fed915ebede37
- MD5 cc6336fbf8e7773e158563462d54aa13
- SHA1 199f1c3a6b9a4e4a2e25b9ad2392b6fd3b8898e0
- SHA512 0032af6fba75dd0ea8ae30946372d00e212a371f544f842367ae6bcd893bfb05b0c9cc5c1e8790f5beaad6fa1df985515214434ef5cc73544c46fb4801a549e9
- TLSH T112016BE1CCA12E770B0199D8CC29244EB22148730C84B8E6BB0D191E1F9BE6F32B213C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\unattended.json
- Size 1KB
- SHA256 87d0676e10af56d0897ad44210f115f98aff0ce714aa874827c79de5f4d8d479
- MD5 fe9d9bd6a356d3ab32b1c403730d43ed
- SHA1 9b560dbd01a8f13bd0dcdf6fb896527fde280e46
- SHA512 dcded827b870c0159c89a3fc6fe2dd21964f7cc73bfa724bc6ab7914ee4e9d333654aa24acf658e9162d52345009055fffedda873babcd1d0860036655788c43
- TLSH T17F11ADE1CC612DB71B01A9D59C19268A726185770C98B4E6BB4D1A1E0F8FE6F31B316C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\3719837408790104989\x64\g2rvdd.inf
- Size 3KB
- SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
- MD5 79c299099a8f43e1a94047355ebdf1cc
- SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
- SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
- TLSH T17671AF47A7EC0618B0B36A80EBF541B65A273C95893CD64D01E442CE1AF1E40D9E3BF7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe
- Size 35.4MB
- SHA256 60ceca48a2fb947a3e7dbc6baad3fe932fcde53fa86227c0b945785f399e095d
- MD5 af07cc0219f4604dc6cf3113d74dd2eb
- SHA1 bac921238605100beb64d9ca320a41f6083065e4
- SHA512 ad697c7f325ce4eede31eb6bf747feece86bd874b27066c1837f5fef886222e5683bec4c939ca1320e42fbf85159173ff6237a41865f01dc344fff16ac47a17a
- SSDEEP 786432:b1zCb7Tze8zqub4cXFVY0KWsFbXqTboVpWWqeq:btCb7f0c1VY0jyb64QWY
- TLSH T15087121BA2E501A4D5BAC078CA6BA547FB723C06133067DF02A4A6565F73AF05E3F325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\GoTo Resolve Unattended\unattended-updater.exe.cmd
- Size 537B
- SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
- MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
- SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
- SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
- TLSH T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 56KB
- SHA256 6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef
- MD5 c26ed30e7d5ab440480838636efc41db
- SHA1 c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591
- SHA512 96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df
- SSDEEP 192:xedRBsKhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:xe+KhBvkZsLRGlzh+vS9
- TLSH T12C4387DF26348100CA07A8BABD71771BBA55D0BFC1C2F0E87A968A1780B457CE775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 56KB
- SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
- MD5 752a1f26b18748311b691c7d8fc20633
- SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
- SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
- SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
- TLSH T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
- Size 64KB
- SHA256 5ddf49babd38d51e063509087f92e3ff2e03c116710eca5e44bd68c1290bf29c
- MD5 9d0d3651b130c267d65cbc18aff184e0
- SHA1 4432a281c04b0bd2b4607d82db25dfd720de0c16
- SHA512 8d21525ff703a5a5d14d9b3310c905479919d770e74bd05ce00a2ad813a3e2f53e6a1a14d7889c628e265ae1e1530c3eae190c18e8fe30a2d2fa1509d5faa06b
- SSDEEP 384:yevdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:K+eUZsLQCZsL3hUS4
- TLSH T13153CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI1B24.tmp
- Size 5.7MB
- SHA256 4841eaaef07e56daef05eb61a2ce9acb023316ef0816aa32204c40c6176a56c3
- MD5 1252e6ad04195c9225dc094815c411c9
- SHA1 b9cef1939e8a83518b0d46e2659ebd7ec8e1666d
- SHA512 65072cd6513c5dab9099810f6fd204f17d0fca3da551030d21c93f7aa0f4850dca3e13baf2b340b48da4faaa0e3be1d03b25a6c82f3b5638ba170d6f7e88558a
- SSDEEP 49152:Mbj9ysbs9yIG1gDOAFhUHU/w5UT8UtAue32O8QXWFvTPrH9/nr3DEBWSMd2Ewrj5:MbN2QjmFracF5cKFdu9CwJsv6tMhG
- TLSH T1EA567C17A2EA0158D9BAC178CA6B9547FB723C0653306BDF02A0A6556F73BF01A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e581642.msi
- Size 37.2MB
- SHA256 16f92782bd3b522b24ea25c3c0707f75d538d49a99b490ed3c24124a6d586535
- MD5 61a515dee5380a93bd5afe980d7dd1e7
- SHA1 0ba0a003eaebd19967bd9c031c8271d709743a82
- SHA512 78b0e3b5d77409b363da181db5e1012e7fff15fdca0cc775b601edfe732c6e221cdc0082ca2725a3644f2518505bce3f1f64bc3d8a1d3ccb998d7e00a62765e9
- SSDEEP 786432:6dwm/GCb6M1VN4OkZVIpkOs0om4B+vf74BALjAZ:62meCbpKVokOsVRBO02j
- TLSH T1EC872217A2EA0164D9BAC138CB6BA546FB723C0513306ADF02A4B6556F73BF05A7F314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{299352ba-e92f-c743-93c6-c5210f81891c}\g2rvdd.cat
- Size 10KB
- SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
- MD5 8d2c58325f63af51d37693e7ffbdbc4d
- SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
- SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
- SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
- TLSH T1492219A2866C4483EA53BC6043E8F9977C3DA7CB681045BA25AFF7691C933C9F30456D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 727B
- SHA256 14fc4a36941bb2e4fc1ba2e1f4941ed7f4dc3ff71db504f5c57e35e71fee0e4f
- MD5 01ba6db664825c80c61aa7ffd5b1b0aa
- SHA1 288279294b014366e6ab2e320a929dfe087f5d46
- SHA512 a30cfc8282a67606921da58931bde85f4855a41d08634ff37a9f4fc98a849f4fc6c04fe74913fcddd0c13b458882ad273e48b626b619a4b7fef7442e9d99fd73
- TLSH T1C001108339AB19B03A8C45B8CD84929DA0E764582ECB1E9AD43524CCD467627BEB3015
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 727B
- SHA256 69cad82266bfddce643a6c2f6b909e66ca584e262e386baf7cac191b590e3e7b
- MD5 4d499bc7c90c822986626d7c897f3e4e
- SHA1 06a61a84fd1be62166fa7139655310f1f535fe1c
- SHA512 6c928ede4eb78c96107f7f0e04afb283a652ad734d1e3d888390db74c1731cec598dd3ef6e547b6e7e6648c5ce6bce69bdf98977ea3879a079f914167e0615de
- TLSH T108011503AB6A8E801B5C8D558FE2B665BED5023446E8554F516715847B876721602A60
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
- Size 400B
- SHA256 8e419e6b6523cc4c0e1df7d86116b1879a4f3c5f73715d4ac6ef7ed2d3874cb4
- MD5 2aa78978bbee43f167a76df005b6969b
- SHA1 4db2fa5e56fff89198105fba88085354282ef891
- SHA512 dcf00b67a98740ed6ee780558c244362ec805b48f9682d6124ada3571cb0589b73987011dd7fb50a7c2fc0a5077972561cb3fc54e8c03db62ba30482d39d5b2d
- TLSH T1B6E0C0151DF5013DF3E6CA75CFC175524849F1529C00C7E60F90054CCE1DF000D528B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_F3911A996680A5E4031AB6109A606645
- Size 408B
- SHA256 d6a4ec1a66b1c9fb8f20031508ad3823d832acddba3a3b1f8a3e3a1dba6a95ae
- MD5 98dfbf42e2742327d92d65adf12e3909
- SHA1 c4defb677d652915bf5ba69f5d87dc2440a4f71d
- SHA512 cadc7c598530ac625dfa75e83bdab8dcc30ade960f7724c609f7a74333854510434b89a348c9e6b81da39f29a3f8a700f925332e62e8b84b7dac0a70922b3168
- TLSH T1DCE0C03472FC004CF1F5F4B482F65821684EF32A344182650D809385AA14F401C91225
- MD5 SHA1 SHA512 TLSH