Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 06:41
General
- Target goldenwoolf.exe
- Size 322KB
- Sample260802-hf4p3sem6x
- SHA256 632b2ea02a89c9d6357a22b418037a5f710cbf6152e74b35aa59cc6ff1190d6f
Malware Config
Signatures
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Disables service(s) 3 TTPs
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\goldenwoolf.exe"C:\Users\Admin\AppData\Local\Temp\goldenwoolf.exe"1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"2⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} recoveryenabled No2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Public\WindowsUpdate.exe" /sc daily /st 00:00 /f 2>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "WindowsUpdate" /tr "C:\Users\Public\WindowsUpdate.exe" /sc daily /st 00:00 /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe"1⤵
- Executes dropped EXE
-
C:\Users\Public\WindowsUpdate.exeC:\Users\Public\WindowsUpdate.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
WindowsUpdate.exe
memory/2976-51-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-53-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-45-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-46-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-47-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-48-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-49-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-40-0x00007FFE4128F000-0x00007FFE41290000-memory.dmp
memory/2976-42-0x000001D723780000-0x000001D7237A2000-memory.dmp
memory/2976-52-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-50-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-54-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-55-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-41-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp
memory/2976-60-0x000001D7237F0000-0x000001D72380E000-memory.dmp
memory/2976-61-0x000001D723810000-0x000001D7238C2000-memory.dmp
memory/2976-62-0x000001D7237D0000-0x000001D7237DA000-memory.dmp
memory/2976-65-0x00007FFE41100000-0x00007FFE41AA4000-memory.dmp