Analysis

  • max time kernel
    101s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 11:24

General

  • Target

    PowerISO8-x64.exe

  • Size

    5.0MB

  • MD5

    42308fcb5833ca389ba781e280cbb8e8

  • SHA1

    f16d1681010efae2a73f98a92d0b3d19d64e7d83

  • SHA256

    cac86780dd560b81feab752a38f05a186477de300d25eeaa7526e7812aec5cd3

  • SHA512

    42efbb1f658faa226d9c64f30ed4439287dc20841c58944012553d0a304bdf0dca6163eec05099b601e47b0b761c76acd41f157ce7f4c5e5ee47518cf7002b92

  • SSDEEP

    98304:CIg29chmuO1d2ZKY6wp9+YbZCK2ycBQQBVC4RJzDiZwd:lg29ccuOT2L6wpJfkQ2V3J3Gwd

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PowerISO8-x64.exe
    "C:\Users\Admin\AppData\Local\Temp\PowerISO8-x64.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5028

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nsiA886.tmp\System.dll

          Filesize

          12KB

          MD5

          8cf2ac271d7679b1d68eefc1ae0c5618

          SHA1

          7cc1caaa747ee16dc894a600a4256f64fa65a9b8

          SHA256

          6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba

          SHA512

          ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

        • C:\Users\Admin\AppData\Local\Temp\nsiA886.tmp\nsjA972.tmp

          Filesize

          29KB

          MD5

          2bdf5a9d2007c879b665b9c631a9cebb

          SHA1

          0937ebd3024adbf14e6c313434de078975fe2e14

          SHA256

          dd8c9f10e6115c70a774dd017b2d300108d7ab082d8475d6e3ad53a0dd45124c

          SHA512

          ee30588bd9c1f6c9c550cd50c3997ea4b14482af7c9fc0ad7ac918680e32e7984f3fb0ca2699f9a27d2e35868c282e1c0af3772609044770d67a753737c27bfc

        • memory/5028-15-0x0000000002320000-0x0000000002330000-memory.dmp

          Filesize

          64KB

        • memory/5028-16-0x0000000073E2E000-0x0000000073E2F000-memory.dmp

          Filesize

          4KB

        • memory/5028-20-0x00000000031C0000-0x00000000031D0000-memory.dmp

          Filesize

          64KB

        • memory/5028-21-0x00000000746C0000-0x00000000746D0000-memory.dmp

          Filesize

          64KB

        • memory/5028-22-0x0000000005500000-0x0000000005AA4000-memory.dmp

          Filesize

          5.6MB

        • memory/5028-23-0x0000000005AF0000-0x0000000005B82000-memory.dmp

          Filesize

          584KB

        • memory/5028-24-0x00000000067D0000-0x0000000006814000-memory.dmp

          Filesize

          272KB

        • memory/5028-25-0x0000000006820000-0x00000000068BC000-memory.dmp

          Filesize

          624KB

        • memory/5028-26-0x00000000068C0000-0x0000000006926000-memory.dmp

          Filesize

          408KB

        • memory/5028-27-0x0000000006980000-0x0000000006EAC000-memory.dmp

          Filesize

          5.2MB

        • memory/5028-30-0x0000000002320000-0x0000000002330000-memory.dmp

          Filesize

          64KB

        • memory/5028-31-0x0000000073E2E000-0x0000000073E2F000-memory.dmp

          Filesize

          4KB