19c2999836ae6dc31a5eb287d5ab3d604b92dc4a8b0620e2ad1265e233b8b77a

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2022, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.3MB
Sample221216-ex4vmaea99
SHA256 19c2999836ae6dc31a5eb287d5ab3d604b92dc4a8b0620e2ad1265e233b8b77a
MD5 009116ec80215a16c66ecc96c1bb2927
SHA1 b557d078d8c56caa8743a4995dc9a43f02e04575
SHA512 4371a49a7611af965bd90ac0628e77109eeb471b871863e9fe30e6a9d6d363d95a7055d2982e3b8c03c73ea33cb0ad7b734f4424b289cd742044ae6f5cec5def
SSDEEP 24576:EiorFGnVpVB9AK/NVFi7DO+Y7gbgZ+NARBOaNIJcxxm7slY7/MiHHZko/q:EiorFGnVpVYK/nmO+ZNAIU+j0iH
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5084	GAPOSUR.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	GAPOSUR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1580	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
32	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1952	file.exe
1952	file.exe
1220	powershell.exe
5108	powershell.exe
1220	powershell.exe
5108	powershell.exe
5084	GAPOSUR.exe
5084	GAPOSUR.exe
832	powershell.exe
4116	powershell.exe
832	powershell.exe
4116	powershell.exe
5084	GAPOSUR.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	file.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	5108	powershell.exe
Token: SeDebugPrivilege	5084	GAPOSUR.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	4116	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 5108	1952	file.exe	82
PID 1952 wrote to memory of 5108	1952	file.exe	82
PID 1952 wrote to memory of 1220	1952	file.exe	84
PID 1952 wrote to memory of 1220	1952	file.exe	84
PID 1952 wrote to memory of 484	1952	file.exe	86
PID 1952 wrote to memory of 484	1952	file.exe	86
PID 484 wrote to memory of 32	484	cmd.exe	88
PID 484 wrote to memory of 32	484	cmd.exe	88
PID 484 wrote to memory of 5084	484	cmd.exe	91
PID 484 wrote to memory of 5084	484	cmd.exe	91
PID 5084 wrote to memory of 832	5084	GAPOSUR.exe	92
PID 5084 wrote to memory of 832	5084	GAPOSUR.exe	92
PID 5084 wrote to memory of 4116	5084	GAPOSUR.exe	95
PID 5084 wrote to memory of 4116	5084	GAPOSUR.exe	95
PID 5084 wrote to memory of 4148	5084	GAPOSUR.exe	96
PID 5084 wrote to memory of 4148	5084	GAPOSUR.exe	96
PID 4148 wrote to memory of 1580	4148	cmd.exe	98
PID 4148 wrote to memory of 1580	4148	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8552.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:32
- - C:\ProgramData\cloud\GAPOSUR.exe
    "C:\ProgramData\cloud\GAPOSUR.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4116
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "GAPOSUR" /tr "C:\ProgramData\cloud\GAPOSUR.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "GAPOSUR" /tr "C:\ProgramData\cloud\GAPOSUR.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GAPOSUR.exe

Path C:\ProgramData\cloud\GAPOSUR.exe
Size 2.3MB
SHA256 19c2999836ae6dc31a5eb287d5ab3d604b92dc4a8b0620e2ad1265e233b8b77a
MD5 009116ec80215a16c66ecc96c1bb2927
SHA1 b557d078d8c56caa8743a4995dc9a43f02e04575
SHA512 4371a49a7611af965bd90ac0628e77109eeb471b871863e9fe30e6a9d6d363d95a7055d2982e3b8c03c73ea33cb0ad7b734f4424b289cd742044ae6f5cec5def
SSDEEP 24576:EiorFGnVpVB9AK/NVFi7DO+Y7gbgZ+NARBOaNIJcxxm7slY7/MiHHZko/q:EiorFGnVpVYK/nmO+ZNAIU+j0iH
MD5 SHA1 SHA512 SSDEEP

Submit Download

GAPOSUR.exe

Path C:\ProgramData\cloud\GAPOSUR.exe
Size 2.3MB
SHA256 19c2999836ae6dc31a5eb287d5ab3d604b92dc4a8b0620e2ad1265e233b8b77a
MD5 009116ec80215a16c66ecc96c1bb2927
SHA1 b557d078d8c56caa8743a4995dc9a43f02e04575
SHA512 4371a49a7611af965bd90ac0628e77109eeb471b871863e9fe30e6a9d6d363d95a7055d2982e3b8c03c73ea33cb0ad7b734f4424b289cd742044ae6f5cec5def
SSDEEP 24576:EiorFGnVpVB9AK/NVFi7DO+Y7gbgZ+NARBOaNIJcxxm7slY7/MiHHZko/q:EiorFGnVpVYK/nmO+ZNAIU+j0iH
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 719589acc67594a2add00dca3c097551163199edbdd59a7f62f783871ef96e17
MD5 46bf20e17dec660ef09b16e41372a7c3
SHA1 cf8daa89a45784a385b75cf5e90d3f59706ac5d5
SHA512 91225c1aac17fa26ec00913d5e96950ed11d44a1fd28f34a1810fe143176864cf2b9624dc053183d8f28db5a3903c5e092aab180fb21ce2a3775223ee111df54
MD5 SHA1 SHA512

Submit Download

tmp8552.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8552.tmp.bat
Size 141B
SHA256 6b63ca6858d8bcec130a8967c70d0e4311e80cc2261e08bab7e9b62688baa317
MD5 f5857b24f7fd7d7c8dfcf6cf4896f399
SHA1 b143de1f6f48dc240c8be4c993c24564c54dbef8
SHA512 55454bc2fe5d5ab9945121e450c0ae71fca3736ba75e534ab9e391fef689e8f1aed3b52540379584d2f3d2e853b7b7a933d9c7e646e49c82dd6bcc827ca71b8e
MD5 SHA1 SHA512

Submit Download

memory/832-187-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/832-182-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1220-152-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1220-158-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1220-149-0x0000016BEA8F0000-0x0000016BEA912000-memory.dmp

Download

memory/1952-141-0x00007FF9DF270000-0x00007FF9DF29B000-memory.dmp

Download

memory/1952-136-0x00007FF9C2B40000-0x00007FF9C2BFD000-memory.dmp

Download

memory/1952-150-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1952-134-0x00007FF9E0200000-0x00007FF9E029E000-memory.dmp

Download

memory/1952-144-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1952-143-0x00007FF9C01E0000-0x00007FF9C032E000-memory.dmp

Download

memory/1952-142-0x0000000000910000-0x0000000000BBE000-memory.dmp

Download

memory/1952-133-0x00007FF9C2C00000-0x00007FF9C2CAA000-memory.dmp

Download

memory/1952-135-0x00007FF9DB9D0000-0x00007FF9DB9E2000-memory.dmp

Download

memory/1952-148-0x0000000000910000-0x0000000000BBE000-memory.dmp

Download

memory/1952-137-0x00007FF9DE440000-0x00007FF9DE5E1000-memory.dmp

Download

memory/1952-140-0x0000000000BC0000-0x0000000000C03000-memory.dmp

Download

memory/1952-138-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/1952-139-0x0000000000910000-0x0000000000BBE000-memory.dmp

Download

memory/1952-151-0x0000000000BC0000-0x0000000000C03000-memory.dmp

Download

memory/4116-181-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/5084-189-0x00007FF9DCE80000-0x00007FF9DCEBB000-memory.dmp

Download

memory/5084-185-0x00007FF9BCD90000-0x00007FF9BCDC5000-memory.dmp

Download

memory/5084-165-0x00007FF9E0200000-0x00007FF9E029E000-memory.dmp

Download

memory/5084-172-0x00007FF9C01E0000-0x00007FF9C032E000-memory.dmp

Download

memory/5084-171-0x0000000000ED0000-0x000000000117E000-memory.dmp

Download

memory/5084-173-0x0000000000ED0000-0x000000000117E000-memory.dmp

Download

memory/5084-175-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/5084-166-0x00007FF9DB9D0000-0x00007FF9DB9E2000-memory.dmp

Download

memory/5084-164-0x00007FF9C2BB0000-0x00007FF9C2C5A000-memory.dmp

Download

memory/5084-169-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/5084-191-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/5084-168-0x00007FF9DE440000-0x00007FF9DE5E1000-memory.dmp

Download

memory/5084-174-0x0000000000A60000-0x0000000000AA3000-memory.dmp

Download

memory/5084-183-0x00007FF9DE170000-0x00007FF9DE197000-memory.dmp

Download

memory/5084-190-0x0000000000ED0000-0x000000000117E000-memory.dmp

Download

memory/5084-170-0x00007FF9DF270000-0x00007FF9DF29B000-memory.dmp

Download

memory/5084-167-0x00007FF9C2AF0000-0x00007FF9C2BAD000-memory.dmp

Download

memory/5084-186-0x00007FF9BAA70000-0x00007FF9BAB72000-memory.dmp

Download

memory/5084-188-0x00007FF9DFD20000-0x00007FF9DFD8B000-memory.dmp

Download

memory/5108-153-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download

memory/5108-159-0x00007FF9C1930000-0x00007FF9C23F1000-memory.dmp

Download