Overview

overview

8

Static

static

3

Portable10...n).cmd

windows10-2004-x64

8

Portable10...n).cmd

windows11-ltsc_2024-x64

8

Portable10...co.exe

windows10-2004-x64

8

Portable10...co.exe

windows11-ltsc_2024-x64

8

Portable10...r2.dll

windows10-2004-x64

1

Portable10...r2.dll

windows11-ltsc_2024-x64

1

Portable10...DI.exe

windows10-2004-x64

8

Portable10...DI.exe

windows11-ltsc_2024-x64

8

Portable10...rk.cmd

windows10-2004-x64

8

Portable10...rk.cmd

windows11-ltsc_2024-x64

8

Portable10...en.cmd

windows10-2004-x64

3

Portable10...en.cmd

windows11-ltsc_2024-x64

3

Portable10...sk.cmd

windows10-2004-x64

3

Portable10...sk.cmd

windows11-ltsc_2024-x64

3

Portable10...rk.cmd

windows10-2004-x64

3

Portable10...rk.cmd

windows11-ltsc_2024-x64

3

Portable10...ib.dll

windows10-2004-x64

1

Portable10...ib.dll

windows11-ltsc_2024-x64

1

Portable10...rt.dll

windows10-2004-x64

1

Portable10...rt.dll

windows11-ltsc_2024-x64

1

Portable10...rt.sys

windows10-2004-x64

3

Portable10...rt.sys

windows11-ltsc_2024-x64

3

Portable10...ll.cmd

windows10-2004-x64

3

Portable10...ll.cmd

windows11-ltsc_2024-x64

3

Portable10...er.cmd

windows10-2004-x64

3

Portable10...er.cmd

windows11-ltsc_2024-x64

3

Portable10....0.exe

windows10-2004-x64

8

Portable10....0.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/07/2026, 12:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Portable10.1.7/driver/tap-windows-9.21.0.exe
  • Size 220KB
  • Sample260724-petxtaga29
  • SHA256 325222566df55b85eeae5247ec08bbf555bf2bde00d14cb1a8cf323df4a97c03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\driver\tap-windows-9.21.0.exe
    "C:\Users\Admin\AppData\Local\Temp\Portable10.1.7\driver\tap-windows-9.21.0.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Program Files\TAP-Windows\bin\devcon.exe
      "C:\Program Files\TAP-Windows\bin\devcon.exe" hwids tap0901
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1768
    • C:\Program Files\TAP-Windows\bin\devcon.exe
      "C:\Program Files\TAP-Windows\bin\devcon.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3544
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5fac03eb-f0ad-664e-95ff-ea9ab3c26672}\oemvista.inf" "9" "4d14a44ff" "00000000000000E0" "WinSta0\Default" "00000000000000EC" "208" "c:\program files\tap-windows\driver"
    1⤵
    • Manipulates Digital Signatures
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:5208
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{96BB79EF-5B03-492F-BCC4-079AA704CBAB} Global\{C9D78022-2DB7-451F-880D-D0BF7AC64D68} C:\Windows\System32\DriverStore\Temp\{3cf1285c-e406-8c43-b20d-e845ce6b5a23}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{3cf1285c-e406-8c43-b20d-e845ce6b5a23}\tap0901.cat
      2⤵
        PID:5672
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_60e27a40aa3a5bf6\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "00000000000000E0" "7782"
      1⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4980
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:1848

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            devcon.exe
            • Path C:\Program Files\TAP-Windows\bin\devcon.exe
            • Size 80KB
            • SHA256 dd330533dc89aeb9fdef2e2cf5cfecef19efd65d46ff2a503d40fb800d2db23d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OemVista.inf
            • Path C:\Program Files\TAP-Windows\driver\OemVista.inf
            • Size 7KB
            • SHA256 ca9f96afd8e3d05c5502078198e6e66610e3df49e7f64a02761095b1ac4362eb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            InstallOptions.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\InstallOptions.dll
            • Size 14KB
            • SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\System.dll
            • Size 11KB
            • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            UserInfo.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\UserInfo.dll
            • Size 4KB
            • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\ioSpecial.ini
            • Size 566B
            • SHA256 0f4b40a51743f2969b98a4293d72baf11d54578dc3ee73af2ffa473a65cdd2cd
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\ioSpecial.ini
            • Size 567B
            • SHA256 04cd17517d3e5a8599808f80c9ac59dd4b2daa9acd69f5390d50f25e8bb0e042
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\ioSpecial.ini
            • Size 689B
            • SHA256 2ec0a5c21c304630f8a3de20e442248f80a9be0351468f7413771147f8364d15
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ioSpecial.ini
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\ioSpecial.ini
            • Size 728B
            • SHA256 fab4aabc6a0d3de4efcdb6197ca67b639bab08f3ebef82ae4940f1dc9253cbeb
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsk34D3.tmp\nsExec.dll
            • Size 6KB
            • SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            oemvista.inf_amd64_60e27a40aa3a5bf6.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_60e27a40aa3a5bf6.ini
            • Size 417B
            • SHA256 ae990153170dd23d12622694c0388c2ee4c8670f7eb6da8c2f06425a8439ec6d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tap0901.sys
            • Path \??\c:\PROGRA~1\TAP-WI~1\driver\tap0901.sys
            • Size 26KB
            • SHA256 b4d7dbddecf5c8e632b1207311bc7899a0e0cd1020a46ecb59955c6b9361cf7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tap0901.cat
            • Path \??\c:\program files\tap-windows\driver\tap0901.cat
            • Size 9KB
            • SHA256 d81e77b1aa7cdc4df057ed7c3d983bd8efd713abc17019b956081c51a112538d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download