Overview
overview
10Static
static
379d775433b...18.exe
windows7-x64
1079d775433b...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PROGRAMFI...ap.bat
windows7-x64
1$PROGRAMFI...ap.bat
windows10-2004-x64
1$PROGRAMFI...ll.bat
windows7-x64
1$PROGRAMFI...ll.bat
windows10-2004-x64
1$PROGRAMFI...on.exe
windows7-x64
1$PROGRAMFI...on.exe
windows10-2004-x64
1$PROGRAMFI...ll.exe
windows7-x64
1$PROGRAMFI...ll.exe
windows10-2004-x64
1$PROGRAMFI...01.sys
windows7-x64
1$PROGRAMFI...01.sys
windows10-2004-x64
1Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Setupres.exe
windows7-x64
9Setupres.exe
windows10-2004-x64
9ipras.vbs
windows7-x64
8ipras.vbs
windows10-2004-x64
8ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
79d775433be505a57ae175f5e6f427af_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
79d775433be505a57ae175f5e6f427af_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/addtap.bat
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/addtap.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/deltapall.bat
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/deltapall.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/devcon.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/devcon.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/tapinstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/tapinstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.sys
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/driver/tap0901.sys
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Setup.exe
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
Setup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
Setupres.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Setupres.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
ipras.vbs
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
ipras.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
ssleay32.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
ssleay32.dll
Resource
win10v2004-20240508-en
General
-
Target
$PROGRAMFILES/Ferr/SEDA/TAP-Windows/bin/deltapall.bat
-
Size
177B
-
MD5
70850be8dc81d8f8c36da0e754df0a46
-
SHA1
fe7766e67239e26f6cee866cb9a93341e33f0e4d
-
SHA256
1be66390df9e302b38553432731a244e65f745d31e6424c88091326fb3ea92d7
-
SHA512
f15a3ce91ceb663a0369054e06647471591ba54ed40e0f6dd549069a0c4e30aefd590c9a18a90d80d35af4fcd45e49d89a259606cf7ee23fa976c61f88a0066b
Malware Config
Signatures
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
tapinstall.exepid process 2004 tapinstall.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exedescription pid process target process PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe PID 2656 wrote to memory of 2004 2656 cmd.exe tapinstall.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Ferr\SEDA\TAP-Windows\bin\deltapall.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Ferr\SEDA\TAP-Windows\bin\tapinstall.exe"tapinstall.exe" remove tap09012⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam