Analysis
- max time kernel
54s - max time network
56s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
16/12/2022, 16:04
General
- Target file.exe
- Size 2.5MB
- Sample221216-thxkbsfa43
- SHA256 ec2eb6345f2e7ef75f0e38a7bd4c60f420a0ff02a8e9b37005855409f0e23aec
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp203E.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\cloud\GAPOSUR.exe"C:\ProgramData\cloud\GAPOSUR.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "GAPOSUR" /tr "C:\ProgramData\cloud\GAPOSUR.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "GAPOSUR" /tr "C:\ProgramData\cloud\GAPOSUR.exe"5⤵
- Creates scheduled task(s)
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
GAPOSUR.exe
GAPOSUR.exe
tmp203E.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
GAPOSUR.exe
memory/636-123-0x0000000002354000-0x0000000002357000-memory.dmp
memory/636-77-0x000007FEECD50000-0x000007FEED773000-memory.dmp
memory/636-134-0x0000000002354000-0x0000000002357000-memory.dmp
memory/636-146-0x0000000002354000-0x0000000002357000-memory.dmp
memory/636-131-0x000000001B740000-0x000000001BA3F000-memory.dmp
memory/636-120-0x000007FEEB2A0000-0x000007FEEBDFD000-memory.dmp
memory/636-147-0x000000000235B000-0x000000000237A000-memory.dmp
memory/768-74-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmp
memory/768-130-0x000000001B720000-0x000000001BA1F000-memory.dmp
memory/768-124-0x000007FEEB2A0000-0x000007FEEBDFD000-memory.dmp
memory/768-78-0x000007FEECD50000-0x000007FEED773000-memory.dmp
memory/768-125-0x0000000002764000-0x0000000002767000-memory.dmp
memory/768-151-0x000000000276B000-0x000000000278A000-memory.dmp
memory/768-135-0x0000000002764000-0x0000000002767000-memory.dmp
memory/768-150-0x0000000002764000-0x0000000002767000-memory.dmp
memory/980-126-0x00000000029B4000-0x00000000029B7000-memory.dmp
memory/980-148-0x00000000029B4000-0x00000000029B7000-memory.dmp
memory/980-133-0x000000001B7F0000-0x000000001BAEF000-memory.dmp
memory/980-117-0x000007FEECD50000-0x000007FEED773000-memory.dmp
memory/980-149-0x00000000029BB000-0x00000000029DA000-memory.dmp
memory/980-136-0x00000000029B4000-0x00000000029B7000-memory.dmp
memory/980-121-0x000007FEEB2A0000-0x000007FEEBDFD000-memory.dmp
memory/1292-83-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1292-82-0x0000000000160000-0x000000000044A000-memory.dmp
memory/1292-56-0x000007FEF6D50000-0x000007FEF6DEC000-memory.dmp
memory/1292-57-0x000007FEFF9E0000-0x000007FEFFA47000-memory.dmp
memory/1292-58-0x0000000077520000-0x000000007761A000-memory.dmp
memory/1292-59-0x000007FEFE190000-0x000007FEFE22F000-memory.dmp
memory/1292-60-0x0000000077620000-0x000000007773F000-memory.dmp
memory/1292-61-0x000007FEFD750000-0x000007FEFD7BC000-memory.dmp
memory/1292-62-0x000007FEFF300000-0x000007FEFF371000-memory.dmp
memory/1292-63-0x000007FEF6AF0000-0x000007FEF6BE7000-memory.dmp
memory/1292-64-0x000007FEFF660000-0x000007FEFF73B000-memory.dmp
memory/1292-65-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp
memory/1292-66-0x0000000000160000-0x000000000044A000-memory.dmp
memory/1292-67-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1292-68-0x000007FEFE320000-0x000007FEFE44D000-memory.dmp
memory/1292-69-0x000007FEFF380000-0x000007FEFF583000-memory.dmp
memory/1292-70-0x0000000000160000-0x000000000044A000-memory.dmp
memory/1292-71-0x000007FEF69C0000-0x000007FEF6AEC000-memory.dmp
memory/1292-81-0x000007FEFF1F0000-0x000007FEFF20F000-memory.dmp
memory/1292-55-0x000007FEF6DF0000-0x000007FEF6E5F000-memory.dmp
memory/1556-90-0x000007FEF6D50000-0x000007FEF6DEC000-memory.dmp
memory/1556-98-0x0000000000110000-0x0000000000153000-memory.dmp
memory/1556-89-0x000007FEF6DF0000-0x000007FEF6E5F000-memory.dmp
memory/1556-119-0x000007FEFF1F0000-0x000007FEFF20F000-memory.dmp
memory/1556-118-0x000007FEFE230000-0x000007FEFE307000-memory.dmp
memory/1556-157-0x0000000000CB0000-0x0000000000F9A000-memory.dmp
memory/1556-111-0x000007FEFBA50000-0x000007FEFBC65000-memory.dmp
memory/1556-128-0x0000000000CB0000-0x0000000000F9A000-memory.dmp
memory/1556-129-0x0000000000110000-0x0000000000153000-memory.dmp
memory/1556-95-0x000007FEFD750000-0x000007FEFD7BC000-memory.dmp
memory/1556-91-0x000007FEFF9E0000-0x000007FEFFA47000-memory.dmp
memory/1556-156-0x000007FEFCBA0000-0x000007FEFCBFB000-memory.dmp
memory/1556-92-0x0000000077520000-0x000000007761A000-memory.dmp
memory/1556-93-0x000007FEFE190000-0x000007FEFE22F000-memory.dmp
memory/1556-155-0x000007FEFD890000-0x000007FEFD8C6000-memory.dmp
memory/1556-94-0x0000000077620000-0x000000007773F000-memory.dmp
memory/1556-154-0x000007FEFB1D0000-0x000007FEFB1F7000-memory.dmp
memory/1556-138-0x000007FEFCED0000-0x000007FEFCEF2000-memory.dmp
memory/1556-139-0x000007FEFCD80000-0x000007FEFCD97000-memory.dmp
memory/1556-104-0x0000000000CB0000-0x0000000000F9A000-memory.dmp
memory/1556-153-0x000007FEFD350000-0x000007FEFD375000-memory.dmp
memory/1556-103-0x000007FEFF380000-0x000007FEFF583000-memory.dmp
memory/1556-102-0x000007FEFE320000-0x000007FEFE44D000-memory.dmp
memory/1556-140-0x000007FEFAB60000-0x000007FEFAB7C000-memory.dmp
memory/1556-141-0x000007FEF1490000-0x000007FEF14F2000-memory.dmp
memory/1556-142-0x000007FEFF2B0000-0x000007FEFF2FD000-memory.dmp
memory/1556-152-0x000007FEFA800000-0x000007FEFA871000-memory.dmp
memory/1556-96-0x0000000000CB0000-0x0000000000F9A000-memory.dmp
memory/1556-101-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp
memory/1556-100-0x000007FEFF660000-0x000007FEFF73B000-memory.dmp
memory/1556-97-0x000007FEFF300000-0x000007FEFF371000-memory.dmp
memory/1556-99-0x000007FEF69F0000-0x000007FEF6AE7000-memory.dmp
memory/1556-143-0x000007FEFA770000-0x000007FEFA7D4000-memory.dmp
memory/1956-116-0x000007FEECD50000-0x000007FEED773000-memory.dmp
memory/1956-145-0x000000000253B000-0x000000000255A000-memory.dmp
memory/1956-144-0x0000000002534000-0x0000000002537000-memory.dmp
memory/1956-132-0x000000001B790000-0x000000001BA8F000-memory.dmp
memory/1956-137-0x0000000002534000-0x0000000002537000-memory.dmp
memory/1956-122-0x000007FEEB2A0000-0x000007FEEBDFD000-memory.dmp
memory/1956-127-0x0000000002534000-0x0000000002537000-memory.dmp