Overview
overview
10Static
static
3PowerISO8-x64 (1).exe
windows11-21h2-x64
10$0.sys
windows11-21h2-x64
1$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...er.bmp
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$TEMP/$0.dll
windows11-21h2-x64
1Lang/Arabic.lng
windows11-21h2-x64
3Lang/Armenian.lng
windows11-21h2-x64
3Lang/Azerbaijani.lng
windows11-21h2-x64
3Lang/Belarusian.lng
windows11-21h2-x64
3Lang/Bosnian.lng
windows11-21h2-x64
3Lang/Bulgarian.lng
windows11-21h2-x64
3Lang/Dutch.lng
windows11-21h2-x64
3Lang/Finnish.lng
windows11-21h2-x64
3Lang/Greek.lng
windows11-21h2-x64
3Lang/Indonesian.lng
windows11-21h2-x64
3Lang/Japanese.lng
windows11-21h2-x64
3Lang/Lithuanian.lng
windows11-21h2-x64
3Lang/Norsk.lng
windows11-21h2-x64
3Lang/Portu...l).lng
windows11-21h2-x64
1Lang/Russian.lng
windows11-21h2-x64
3Lang/SimpChinese.lng
windows11-21h2-x64
3Lang/Spanish.lng
windows11-21h2-x64
3Lang/Thai.lng
windows11-21h2-x64
3Lang/Turkish.lng
windows11-21h2-x64
3Lang/Urdu(...n).lng
windows11-21h2-x64
1Lang/croatian.lng
windows11-21h2-x64
3Lang/danish.lng
windows11-21h2-x64
3Lang/kazakh.lng
windows11-21h2-x64
3devcon.exe
windows11-21h2-x64
1piso.exe
windows11-21h2-x64
1setup64.exe
windows11-21h2-x64
1Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
PowerISO8-x64 (1).exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
$0.sys
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
$TEMP/$0.dll
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
Lang/Arabic.lng
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
Lang/Armenian.lng
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
Lang/Azerbaijani.lng
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
Lang/Belarusian.lng
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
Lang/Bosnian.lng
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
Lang/Bulgarian.lng
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
Lang/Dutch.lng
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
Lang/Finnish.lng
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
Lang/Greek.lng
Resource
win11-20240412-en
Behavioral task
behavioral16
Sample
Lang/Indonesian.lng
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
Lang/Japanese.lng
Resource
win11-20240412-en
Behavioral task
behavioral18
Sample
Lang/Lithuanian.lng
Resource
win11-20240412-en
Behavioral task
behavioral19
Sample
Lang/Norsk.lng
Resource
win11-20240412-en
Behavioral task
behavioral20
Sample
Lang/Portuguese(Brazil).lng
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
Lang/Russian.lng
Resource
win11-20240412-en
Behavioral task
behavioral22
Sample
Lang/SimpChinese.lng
Resource
win11-20240412-en
Behavioral task
behavioral23
Sample
Lang/Spanish.lng
Resource
win11-20240412-en
Behavioral task
behavioral24
Sample
Lang/Thai.lng
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
Lang/Turkish.lng
Resource
win11-20240412-en
Behavioral task
behavioral26
Sample
Lang/Urdu(Pakistan).lng
Resource
win11-20240412-en
Behavioral task
behavioral27
Sample
Lang/croatian.lng
Resource
win11-20240412-en
Behavioral task
behavioral28
Sample
Lang/danish.lng
Resource
win11-20240412-en
Behavioral task
behavioral29
Sample
Lang/kazakh.lng
Resource
win11-20240412-en
Behavioral task
behavioral30
Sample
devcon.exe
Resource
win11-20240412-en
Behavioral task
behavioral31
Sample
piso.exe
Resource
win11-20240412-en
Behavioral task
behavioral32
Sample
setup64.exe
Resource
win11-20240412-en
General
-
Target
Lang/Norsk.lng
-
Size
95KB
-
MD5
0f4841f83c8597bd7e11a152c924572e
-
SHA1
3401ae67615f52fb90322a968c531d11c82659a4
-
SHA256
04fcd3084b3759ea6ae31551c9b344fa1cd26b555fd9e9fe36c9313de72c9052
-
SHA512
c94e8ee36f347b948fa551941016b0f99613267901d089aba3fb53ef7759ca4071ca3df307f3bff6d04c8ef16b69a6d9cc85942357b49d26cd936bcf22a75259
-
SSDEEP
1536:dwqUt34hhY/GG0Xpa2Hnjv4dYbiZCmidim/85Wtbw8N6lPbJFtdjSK7DthKuMLPA:dBUt34hhY/GG0Xpa2HnjwdYbiZCmidiX
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3516 OpenWith.exe