Overview
overview
10Static
static
379d775433b...18.exe
windows7-x64
1079d775433b...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PROGRAMFI...ap.bat
windows7-x64
1$PROGRAMFI...ap.bat
windows10-2004-x64
1$PROGRAMFI...ll.bat
windows7-x64
1$PROGRAMFI...ll.bat
windows10-2004-x64
1$PROGRAMFI...on.exe
windows7-x64
1$PROGRAMFI...on.exe
windows10-2004-x64
1$PROGRAMFI...ll.exe
windows7-x64
1$PROGRAMFI...ll.exe
windows10-2004-x64
1$PROGRAMFI...01.sys
windows7-x64
1$PROGRAMFI...01.sys
windows10-2004-x64
1Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Setupres.exe
windows7-x64
9Setupres.exe
windows10-2004-x64
9ipras.vbs
windows7-x64
8ipras.vbs
windows10-2004-x64
8ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
79d775433be505a57ae175f5e6f427af_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
79d775433be505a57ae175f5e6f427af_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/addtap.bat
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/addtap.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/deltapall.bat
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/deltapall.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/devcon.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/devcon.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/tapinstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/tapinstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.sys
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.sys
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Setup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Setupres.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Setupres.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
ipras.vbs
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
ipras.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
ssleay32.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
ssleay32.dll
Resource
win10v2004-20240508-en
General
-
Target
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/addtap.bat
-
Size
114B
-
MD5
ebb2c28da7de8436995509782ac63c4c
-
SHA1
7d693538baa80ce6938f0400bdc16f9b035baee9
-
SHA256
effe5c5c2cf6547a54f987fef6f052a234770b4fcfae277cf6089daa896bcd5f
-
SHA512
021098b1d9f4b987b85be073bc1a6a7ee3336c88d54770d64fc77b74ca74ec459f89fbd65a6fba3efa4f6da7cc852784e9ea391189831f565d64e65a437fc7f5
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tapinstall.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 tapinstall.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 788 wrote to memory of 1396 788 cmd.exe tapinstall.exe PID 788 wrote to memory of 1396 788 cmd.exe tapinstall.exe PID 788 wrote to memory of 1396 788 cmd.exe tapinstall.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Ferr\SEDA\TAP-Windows\bin\addtap.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Ferr\SEDA\TAP-Windows\bin\tapinstall.exe"tapinstall.exe" install "..\driver\OemVista.inf" tap09012⤵
- Checks SCSI registry key(s)