Overview
overview
10Static
static
3PowerISO8-x64 (1).exe
windows11-21h2-x64
10$0.sys
windows11-21h2-x64
1$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...er.bmp
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$TEMP/$0.dll
windows11-21h2-x64
1Lang/Arabic.lng
windows11-21h2-x64
3Lang/Armenian.lng
windows11-21h2-x64
3Lang/Azerbaijani.lng
windows11-21h2-x64
3Lang/Belarusian.lng
windows11-21h2-x64
3Lang/Bosnian.lng
windows11-21h2-x64
3Lang/Bulgarian.lng
windows11-21h2-x64
3Lang/Dutch.lng
windows11-21h2-x64
3Lang/Finnish.lng
windows11-21h2-x64
3Lang/Greek.lng
windows11-21h2-x64
3Lang/Indonesian.lng
windows11-21h2-x64
3Lang/Japanese.lng
windows11-21h2-x64
3Lang/Lithuanian.lng
windows11-21h2-x64
3Lang/Norsk.lng
windows11-21h2-x64
3Lang/Portu...l).lng
windows11-21h2-x64
1Lang/Russian.lng
windows11-21h2-x64
3Lang/SimpChinese.lng
windows11-21h2-x64
3Lang/Spanish.lng
windows11-21h2-x64
3Lang/Thai.lng
windows11-21h2-x64
3Lang/Turkish.lng
windows11-21h2-x64
3Lang/Urdu(...n).lng
windows11-21h2-x64
1Lang/croatian.lng
windows11-21h2-x64
3Lang/danish.lng
windows11-21h2-x64
3Lang/kazakh.lng
windows11-21h2-x64
3devcon.exe
windows11-21h2-x64
1piso.exe
windows11-21h2-x64
1setup64.exe
windows11-21h2-x64
1Analysis
-
max time kernel
91s -
max time network
102s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
PowerISO8-x64 (1).exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
$0.sys
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
$TEMP/$0.dll
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
Lang/Arabic.lng
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
Lang/Armenian.lng
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
Lang/Azerbaijani.lng
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
Lang/Belarusian.lng
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
Lang/Bosnian.lng
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
Lang/Bulgarian.lng
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
Lang/Dutch.lng
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
Lang/Finnish.lng
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
Lang/Greek.lng
Resource
win11-20240412-en
Behavioral task
behavioral16
Sample
Lang/Indonesian.lng
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
Lang/Japanese.lng
Resource
win11-20240412-en
Behavioral task
behavioral18
Sample
Lang/Lithuanian.lng
Resource
win11-20240412-en
Behavioral task
behavioral19
Sample
Lang/Norsk.lng
Resource
win11-20240412-en
Behavioral task
behavioral20
Sample
Lang/Portuguese(Brazil).lng
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
Lang/Russian.lng
Resource
win11-20240412-en
Behavioral task
behavioral22
Sample
Lang/SimpChinese.lng
Resource
win11-20240412-en
Behavioral task
behavioral23
Sample
Lang/Spanish.lng
Resource
win11-20240412-en
Behavioral task
behavioral24
Sample
Lang/Thai.lng
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
Lang/Turkish.lng
Resource
win11-20240412-en
Behavioral task
behavioral26
Sample
Lang/Urdu(Pakistan).lng
Resource
win11-20240412-en
Behavioral task
behavioral27
Sample
Lang/croatian.lng
Resource
win11-20240412-en
Behavioral task
behavioral28
Sample
Lang/danish.lng
Resource
win11-20240412-en
Behavioral task
behavioral29
Sample
Lang/kazakh.lng
Resource
win11-20240412-en
Behavioral task
behavioral30
Sample
devcon.exe
Resource
win11-20240412-en
Behavioral task
behavioral31
Sample
piso.exe
Resource
win11-20240412-en
Behavioral task
behavioral32
Sample
setup64.exe
Resource
win11-20240412-en
General
-
Target
$PLUGINSDIR/modern-header.bmp
-
Size
68KB
-
MD5
ca2542b0e66e48d7e3f361c8eef8f720
-
SHA1
368093fbcbf5dfe2cd58e77f2d6eee7ea5b808cb
-
SHA256
4566dfcc153cba168a02eebc5ddd9d82832cf463ebb8ecb4ec2f269f9f85aeca
-
SHA512
72296dd3d0a741caf051a326cd703b59132136bccbe43c000cf4e57e3d7955aa812501a59f4f62530b2a2b8a73bebf55d32aa428a869c4c840fc16bca1788a33
-
SSDEEP
384:tZfV37EjIopEmmR2vqTf73cynNOBD97H5x1QJOa5/LIsW4Jl7tJegwf0NY:rejIodmMiTDzNOBV/o5/jJl7DTNY
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3592 OpenWith.exe