Overview
overview
10Static
static
3PowerISO8-x64 (1).exe
windows11-21h2-x64
10$0.sys
windows11-21h2-x64
1$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...er.bmp
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$TEMP/$0.dll
windows11-21h2-x64
1Lang/Arabic.lng
windows11-21h2-x64
3Lang/Armenian.lng
windows11-21h2-x64
3Lang/Azerbaijani.lng
windows11-21h2-x64
3Lang/Belarusian.lng
windows11-21h2-x64
3Lang/Bosnian.lng
windows11-21h2-x64
3Lang/Bulgarian.lng
windows11-21h2-x64
3Lang/Dutch.lng
windows11-21h2-x64
3Lang/Finnish.lng
windows11-21h2-x64
3Lang/Greek.lng
windows11-21h2-x64
3Lang/Indonesian.lng
windows11-21h2-x64
3Lang/Japanese.lng
windows11-21h2-x64
3Lang/Lithuanian.lng
windows11-21h2-x64
3Lang/Norsk.lng
windows11-21h2-x64
3Lang/Portu...l).lng
windows11-21h2-x64
1Lang/Russian.lng
windows11-21h2-x64
3Lang/SimpChinese.lng
windows11-21h2-x64
3Lang/Spanish.lng
windows11-21h2-x64
3Lang/Thai.lng
windows11-21h2-x64
3Lang/Turkish.lng
windows11-21h2-x64
3Lang/Urdu(...n).lng
windows11-21h2-x64
1Lang/croatian.lng
windows11-21h2-x64
3Lang/danish.lng
windows11-21h2-x64
3Lang/kazakh.lng
windows11-21h2-x64
3devcon.exe
windows11-21h2-x64
1piso.exe
windows11-21h2-x64
1setup64.exe
windows11-21h2-x64
1Analysis
-
max time kernel
147s -
max time network
163s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
PowerISO8-x64 (1).exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
$0.sys
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
$TEMP/$0.dll
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
Lang/Arabic.lng
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
Lang/Armenian.lng
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
Lang/Azerbaijani.lng
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
Lang/Belarusian.lng
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
Lang/Bosnian.lng
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
Lang/Bulgarian.lng
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
Lang/Dutch.lng
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
Lang/Finnish.lng
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
Lang/Greek.lng
Resource
win11-20240412-en
Behavioral task
behavioral16
Sample
Lang/Indonesian.lng
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
Lang/Japanese.lng
Resource
win11-20240412-en
Behavioral task
behavioral18
Sample
Lang/Lithuanian.lng
Resource
win11-20240412-en
Behavioral task
behavioral19
Sample
Lang/Norsk.lng
Resource
win11-20240412-en
Behavioral task
behavioral20
Sample
Lang/Portuguese(Brazil).lng
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
Lang/Russian.lng
Resource
win11-20240412-en
Behavioral task
behavioral22
Sample
Lang/SimpChinese.lng
Resource
win11-20240412-en
Behavioral task
behavioral23
Sample
Lang/Spanish.lng
Resource
win11-20240412-en
Behavioral task
behavioral24
Sample
Lang/Thai.lng
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
Lang/Turkish.lng
Resource
win11-20240412-en
Behavioral task
behavioral26
Sample
Lang/Urdu(Pakistan).lng
Resource
win11-20240412-en
Behavioral task
behavioral27
Sample
Lang/croatian.lng
Resource
win11-20240412-en
Behavioral task
behavioral28
Sample
Lang/danish.lng
Resource
win11-20240412-en
Behavioral task
behavioral29
Sample
Lang/kazakh.lng
Resource
win11-20240412-en
Behavioral task
behavioral30
Sample
devcon.exe
Resource
win11-20240412-en
Behavioral task
behavioral31
Sample
piso.exe
Resource
win11-20240412-en
Behavioral task
behavioral32
Sample
setup64.exe
Resource
win11-20240412-en
General
-
Target
Lang/SimpChinese.lng
-
Size
42KB
-
MD5
0141ebfde7cf2b57d6e679be189dae36
-
SHA1
d49d0ec9aa37eca802e30716ce3b534bf00ab263
-
SHA256
9b17b55cabc0f7ae7485c62cda0b94868752d23ebc02df8b78cfbc2d2bd83f71
-
SHA512
fc972cb24f94b717cd0078d224ddd5ae6c54048eb0feb5dea42ebc1555aecea306f299c66d3d33292c39bb4f222502623080e06b08a3f1f3aa37a926f3df0633
-
SSDEEP
768:Z+ml9UnF5vFQ995gbKrkm0EGDEhZgVHM8EYeQoOSm0ayOpfo+DazIEJ:AmlULvFU95gbKAm0BbVHM8ELEpo+DjEJ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1984 OpenWith.exe