Analysis
- max time kernel
51s - max time network
59s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
16/12/2022, 04:20
General
- Target file.exe
- Size 2.3MB
- Sample221216-ex4vmaea99
- SHA256 19c2999836ae6dc31a5eb287d5ab3d604b92dc4a8b0620e2ad1265e233b8b77a
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpBA5.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\cloud\GAPOSUR.exe"C:\ProgramData\cloud\GAPOSUR.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "GAPOSUR" /tr "C:\ProgramData\cloud\GAPOSUR.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "GAPOSUR" /tr "C:\ProgramData\cloud\GAPOSUR.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
GAPOSUR.exe
GAPOSUR.exe
tmpBA5.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
GAPOSUR.exe
memory/608-127-0x000007FEEB260000-0x000007FEEBDBD000-memory.dmp
memory/608-149-0x000000000249B000-0x00000000024BA000-memory.dmp
memory/608-157-0x0000000002494000-0x0000000002497000-memory.dmp
memory/608-158-0x000000000249B000-0x00000000024BA000-memory.dmp
memory/608-139-0x000000001B710000-0x000000001BA0F000-memory.dmp
memory/608-143-0x0000000002494000-0x0000000002497000-memory.dmp
memory/608-125-0x0000000002494000-0x0000000002497000-memory.dmp
memory/608-115-0x000007FEECD10000-0x000007FEED733000-memory.dmp
memory/816-69-0x000007FEFDD70000-0x000007FEFDF73000-memory.dmp
memory/816-64-0x000007FEFDBC0000-0x000007FEFDC9B000-memory.dmp
memory/816-56-0x000007FEF6390000-0x000007FEF642C000-memory.dmp
memory/816-57-0x000007FEFDA70000-0x000007FEFDAD7000-memory.dmp
memory/816-58-0x0000000076AF0000-0x0000000076BEA000-memory.dmp
memory/816-71-0x000007FEF5F90000-0x000007FEF60BC000-memory.dmp
memory/816-70-0x00000000001E0000-0x000000000048E000-memory.dmp
memory/816-82-0x000007FEFD8F0000-0x000007FEFD90F000-memory.dmp
memory/816-83-0x00000000001E0000-0x000000000048E000-memory.dmp
memory/816-84-0x0000000000A40000-0x0000000000A83000-memory.dmp
memory/816-55-0x000007FEF6430000-0x000007FEF649F000-memory.dmp
memory/816-59-0x000007FEFDAF0000-0x000007FEFDB8F000-memory.dmp
memory/816-68-0x000007FEFD2A0000-0x000007FEFD3CD000-memory.dmp
memory/816-60-0x0000000076BF0000-0x0000000076D0F000-memory.dmp
memory/816-67-0x0000000000A40000-0x0000000000A83000-memory.dmp
memory/816-66-0x00000000001E0000-0x000000000048E000-memory.dmp
memory/816-65-0x000007FEF5360000-0x000007FEF5D4C000-memory.dmp
memory/816-61-0x000007FEFCBF0000-0x000007FEFCC5C000-memory.dmp
memory/816-62-0x000007FEFD220000-0x000007FEFD291000-memory.dmp
memory/816-63-0x000007FEF60C0000-0x000007FEF61B7000-memory.dmp
memory/852-152-0x00000000024BB000-0x00000000024DA000-memory.dmp
memory/852-124-0x000007FEEB260000-0x000007FEEBDBD000-memory.dmp
memory/852-74-0x000007FEFB731000-0x000007FEFB733000-memory.dmp
memory/852-126-0x00000000024B4000-0x00000000024B7000-memory.dmp
memory/852-138-0x000000001B760000-0x000000001BA5F000-memory.dmp
memory/852-144-0x00000000024B4000-0x00000000024B7000-memory.dmp
memory/852-80-0x000007FEECD10000-0x000007FEED733000-memory.dmp
memory/852-160-0x00000000024BB000-0x00000000024DA000-memory.dmp
memory/852-159-0x00000000024B4000-0x00000000024B7000-memory.dmp
memory/1396-154-0x000000000251B000-0x000000000253A000-memory.dmp
memory/1396-150-0x000000000251B000-0x000000000253A000-memory.dmp
memory/1396-120-0x000007FEEB260000-0x000007FEEBDBD000-memory.dmp
memory/1396-140-0x0000000002514000-0x0000000002517000-memory.dmp
memory/1396-153-0x0000000002514000-0x0000000002517000-memory.dmp
memory/1396-135-0x000000001B8B0000-0x000000001BBAF000-memory.dmp
memory/1396-122-0x0000000002514000-0x0000000002517000-memory.dmp
memory/1396-81-0x000007FEECD10000-0x000007FEED733000-memory.dmp
memory/1540-121-0x000007FEEB260000-0x000007FEEBDBD000-memory.dmp
memory/1540-156-0x00000000028EB000-0x000000000290A000-memory.dmp
memory/1540-123-0x00000000028E4000-0x00000000028E7000-memory.dmp
memory/1540-155-0x00000000028E4000-0x00000000028E7000-memory.dmp
memory/1540-151-0x00000000028EB000-0x000000000290A000-memory.dmp
memory/1540-146-0x000000001B850000-0x000000001BB4F000-memory.dmp
memory/1540-117-0x000007FEECD10000-0x000007FEED733000-memory.dmp
memory/1540-141-0x00000000028E4000-0x00000000028E7000-memory.dmp
memory/1704-142-0x000007FEFC920000-0x000007FEFC945000-memory.dmp
memory/1704-100-0x000007FEFDBC0000-0x000007FEFDC9B000-memory.dmp
memory/1704-131-0x000007FEFC350000-0x000007FEFC367000-memory.dmp
memory/1704-104-0x0000000000F50000-0x00000000011FE000-memory.dmp
memory/1704-133-0x000007FEF0A80000-0x000007FEF0AE2000-memory.dmp
memory/1704-134-0x000007FEFD8A0000-0x000007FEFD8ED000-memory.dmp
memory/1704-136-0x000007FEF9D40000-0x000007FEF9DA4000-memory.dmp
memory/1704-103-0x000007FEFDD70000-0x000007FEFDF73000-memory.dmp
memory/1704-130-0x000007FEFC4A0000-0x000007FEFC4C2000-memory.dmp
memory/1704-102-0x000007FEFD2A0000-0x000007FEFD3CD000-memory.dmp
memory/1704-128-0x0000000000F50000-0x00000000011FE000-memory.dmp
memory/1704-101-0x000007FEF4970000-0x000007FEF535C000-memory.dmp
memory/1704-137-0x000007FEF9DB0000-0x000007FEF9E21000-memory.dmp
memory/1704-145-0x000007FEFA6A0000-0x000007FEFA6C7000-memory.dmp
memory/1704-147-0x000007FEFCB90000-0x000007FEFCBC6000-memory.dmp
memory/1704-148-0x000007FEFC170000-0x000007FEFC1CB000-memory.dmp
memory/1704-132-0x000007FEF9F30000-0x000007FEF9F4C000-memory.dmp
memory/1704-129-0x00000000004E0000-0x0000000000523000-memory.dmp
memory/1704-99-0x000007FEF5FC0000-0x000007FEF60B7000-memory.dmp
memory/1704-98-0x000007FEFD220000-0x000007FEFD291000-memory.dmp
memory/1704-97-0x000007FEFCBF0000-0x000007FEFCC5C000-memory.dmp
memory/1704-96-0x0000000076BF0000-0x0000000076D0F000-memory.dmp
memory/1704-112-0x000007FEFB190000-0x000007FEFB3A5000-memory.dmp
memory/1704-95-0x000007FEFDAF0000-0x000007FEFDB8F000-memory.dmp
memory/1704-94-0x0000000076AF0000-0x0000000076BEA000-memory.dmp
memory/1704-93-0x000007FEFDA70000-0x000007FEFDAD7000-memory.dmp
memory/1704-118-0x000007FEFD6B0000-0x000007FEFD787000-memory.dmp
memory/1704-119-0x000007FEFD8F0000-0x000007FEFD90F000-memory.dmp
memory/1704-92-0x000007FEF6390000-0x000007FEF642C000-memory.dmp
memory/1704-91-0x000007FEF6430000-0x000007FEF649F000-memory.dmp
memory/1704-90-0x00000000004E0000-0x0000000000523000-memory.dmp