Overview
overview
10Static
static
3PowerISO8-x64 (1).exe
windows11-21h2-x64
10$0.sys
windows11-21h2-x64
1$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...er.bmp
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$TEMP/$0.dll
windows11-21h2-x64
1Lang/Arabic.lng
windows11-21h2-x64
3Lang/Armenian.lng
windows11-21h2-x64
3Lang/Azerbaijani.lng
windows11-21h2-x64
3Lang/Belarusian.lng
windows11-21h2-x64
3Lang/Bosnian.lng
windows11-21h2-x64
3Lang/Bulgarian.lng
windows11-21h2-x64
3Lang/Dutch.lng
windows11-21h2-x64
3Lang/Finnish.lng
windows11-21h2-x64
3Lang/Greek.lng
windows11-21h2-x64
3Lang/Indonesian.lng
windows11-21h2-x64
3Lang/Japanese.lng
windows11-21h2-x64
3Lang/Lithuanian.lng
windows11-21h2-x64
3Lang/Norsk.lng
windows11-21h2-x64
3Lang/Portu...l).lng
windows11-21h2-x64
1Lang/Russian.lng
windows11-21h2-x64
3Lang/SimpChinese.lng
windows11-21h2-x64
3Lang/Spanish.lng
windows11-21h2-x64
3Lang/Thai.lng
windows11-21h2-x64
3Lang/Turkish.lng
windows11-21h2-x64
3Lang/Urdu(...n).lng
windows11-21h2-x64
1Lang/croatian.lng
windows11-21h2-x64
3Lang/danish.lng
windows11-21h2-x64
3Lang/kazakh.lng
windows11-21h2-x64
3devcon.exe
windows11-21h2-x64
1piso.exe
windows11-21h2-x64
1setup64.exe
windows11-21h2-x64
1Analysis
-
max time kernel
92s -
max time network
106s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
PowerISO8-x64 (1).exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
$0.sys
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
$TEMP/$0.dll
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
Lang/Arabic.lng
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
Lang/Armenian.lng
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
Lang/Azerbaijani.lng
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
Lang/Belarusian.lng
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
Lang/Bosnian.lng
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
Lang/Bulgarian.lng
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
Lang/Dutch.lng
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
Lang/Finnish.lng
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
Lang/Greek.lng
Resource
win11-20240412-en
Behavioral task
behavioral16
Sample
Lang/Indonesian.lng
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
Lang/Japanese.lng
Resource
win11-20240412-en
Behavioral task
behavioral18
Sample
Lang/Lithuanian.lng
Resource
win11-20240412-en
Behavioral task
behavioral19
Sample
Lang/Norsk.lng
Resource
win11-20240412-en
Behavioral task
behavioral20
Sample
Lang/Portuguese(Brazil).lng
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
Lang/Russian.lng
Resource
win11-20240412-en
Behavioral task
behavioral22
Sample
Lang/SimpChinese.lng
Resource
win11-20240412-en
Behavioral task
behavioral23
Sample
Lang/Spanish.lng
Resource
win11-20240412-en
Behavioral task
behavioral24
Sample
Lang/Thai.lng
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
Lang/Turkish.lng
Resource
win11-20240412-en
Behavioral task
behavioral26
Sample
Lang/Urdu(Pakistan).lng
Resource
win11-20240412-en
Behavioral task
behavioral27
Sample
Lang/croatian.lng
Resource
win11-20240412-en
Behavioral task
behavioral28
Sample
Lang/danish.lng
Resource
win11-20240412-en
Behavioral task
behavioral29
Sample
Lang/kazakh.lng
Resource
win11-20240412-en
Behavioral task
behavioral30
Sample
devcon.exe
Resource
win11-20240412-en
Behavioral task
behavioral31
Sample
piso.exe
Resource
win11-20240412-en
Behavioral task
behavioral32
Sample
setup64.exe
Resource
win11-20240412-en
General
-
Target
Lang/croatian.lng
-
Size
61KB
-
MD5
b94e0fe2974e41da7639cb9691fc8c96
-
SHA1
28f490c0582088bb4790fd3c1430fc37662c6ed1
-
SHA256
b20d52aeaf8a51049ac2e9bfcdf5047b37e17acefc1b98ab982e9cabf7d2b8e7
-
SHA512
54df0156aa833eb661b8083e6415d9cee7928521d13329174680de34af263d87e8fc7291533acb52f1f23372681c2f6adda6b56f4bff97ade20fec807434ae37
-
SSDEEP
768:/4dktpSXv0XHgodUCNjRuT0Jwo4kus4klZv+61Ut5ebRqFtsQ9e6jXRxsQ8ZCv5:/4etpFPdUn0Jf+61pGJ9jHsQ8ZCv5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4564 OpenWith.exe