Overview
overview
8Static
static
3PowerISO9-x64.exe
windows10-ltsc_2021-x64
8PowerISO9-x64.exe
windows11-21h2-x64
8$R0.exe
windows10-ltsc_2021-x64
1$R0.exe
windows11-21h2-x64
1devcon.exe
windows10-ltsc_2021-x64
1devcon.exe
windows11-21h2-x64
1setup64.exe
windows10-ltsc_2021-x64
1setup64.exe
windows11-21h2-x64
1Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 19:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
PowerISO9-x64.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
PowerISO9-x64.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
$R0.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
$R0.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
devcon.exe
Resource
win10ltsc2021-20251017-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
devcon.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
setup64.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
setup64.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target PowerISO9-x64.exe
- Size 5.5MB
- Sample260507-xvcbpsht4y
- SHA256 104fd55a9c9afe36eaa2f6dbbcd2de37b14c807d3d94abd53a0460a1ad31fe38
- MD5 ada6e99deca259e00bb4aaf68bfa7281
- SHA1 7cb951af9acad3652d1464d88d7caecd9a6be0d2
- SHA512 67b68cffd3f174ee557c372c0ce4a9eee167733c9ccf60fbd30a4d91f0227dbdb51245abf6a8f648d9a3b93bfc0a0da5f69c09308c13507e3430f5b4f3e76bbb
- SSDEEP 98304:/JnqxF3UCmd06aowGwmogGfJC7NDhHZnmNx4ro9sjARKLYUfJE2w5AnZC:/JnsUH09xqE45tEQro9ELYUfJE2wAZC
- TLSH T11C46334676888AB6C40D05B1DF7A4720E9F7EC60AAF2DF4363D17724D6A08D35E462CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\Drivers\scdemu.sys setup64.exe File opened for modification C:\Windows\system32\Drivers\scdemu.sys setup64.exe - Executes dropped EXE 2 IoCs
pid Process 4336 devcon.exe 1072 setup64.exe - Loads dropped DLL 2 IoCs
pid Process 4892 PowerISO9-x64.exe 4892 PowerISO9-x64.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 60 IoCs
description ioc Process File created C:\Program Files\PowerISO\Lang\English.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Polish.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Lithuanian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Japanese.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Slovenian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Norsk.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Farsi.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Urdu(Pakistan).ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\License.txt PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Turkish.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Burmese.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\TradChinese.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\7z-x64.dll PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Hungarian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Romanian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\piso.exe PowerISO9-x64.exe File created C:\Program Files\PowerISO\PowerISO.chm PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Malay.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\unrar64.dll PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Thai.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\croatian.ini PowerISO9-x64.exe File opened for modification C:\Program Files\PowerISO\PowerISO.exe PowerISO9-x64.exe File created C:\Program Files\PowerISO\setup64.exe PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Arabic.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Bulgarian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Greek.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Azerbaijani.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Italian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\libvorbis.DLL PowerISO9-x64.exe File created C:\Program Files\PowerISO\Readme.txt PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\SimpChinese.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Armenian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Slovak.ini PowerISO9-x64.exe File opened for modification C:\Program Files\PowerISO\devcon.exe PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Swedish.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Portuguese(Brazil).ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\danish.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\kazakh.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\lame_enc.dll PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Dutch.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\uninstall.exe PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Korean.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\czech.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Spanish.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Vietnamese.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Finnish.ini PowerISO9-x64.exe File opened for modification C:\Program Files\PowerISO\PWRISOVM.EXE PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\German.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Russian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Belarusian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\MACDll.DLL PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\French.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Bosnian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\libFLAC.DLL PowerISO9-x64.exe File opened for modification C:\Program Files\PowerISO\PWRISOSH.DLL PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Ukrainian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Serbian(cyrl).ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Indonesian.ini PowerISO9-x64.exe File created C:\Program Files\PowerISO\Lang\Portuguese(Portugal).ini PowerISO9-x64.exe File opened for modification C:\Program Files\PowerISO\PWRISOVM.exe PowerISO9-x64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PowerISO9-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID devcon.exe - Modifies registry class 50 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vcd PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bz2 PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.001 PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pxi PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dsk PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tar PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gz PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gzip PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tgz PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txz PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cif PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nrg PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.7z PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.flp PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ipsw PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lzma PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zpaq PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cdr PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2 PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lha PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mdf PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.b5i PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ncd PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cdi PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.p01 PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.c2d PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ima PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wim PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bzip2 PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xz PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmg PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cue PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.img PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zipx PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cab PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bwi PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gi PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bif PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mds PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zip PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ashdisc PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lcd PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.esd PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pkg PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bin PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdi PowerISO9-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fcd PowerISO9-x64.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4892 wrote to memory of 5952 4892 PowerISO9-x64.exe 79 PID 4892 wrote to memory of 4336 4892 PowerISO9-x64.exe 80 PID 4892 wrote to memory of 1072 4892 PowerISO9-x64.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\PowerISO9-x64.exe"C:\Users\Admin\AppData\Local\Temp\PowerISO9-x64.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s /u "C:\Program Files\PowerISO\PWRISOSH.DLL"2⤵
- System Location Discovery: System Language Discovery
PID:5952
-
-
C:\Program Files\PowerISO\devcon.exe"C:\Program Files\PowerISO\devcon.exe" remove *scdbusDevice2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4336
-
-
C:\Program Files\PowerISO\setup64.exe"C:\Program Files\PowerISO\setup64.exe" cp C:\Users\Admin\AppData\Local\Temp\nsf45F0.tmp "C:\Windows\system32\Drivers\scdemu.sys"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:1072
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\PowerISO\PowerISO.exe
- Size 7.8MB
- SHA256 93754a064c4ff5faf023579eeab20fdc4e0600614318ecf64204e50c74f5edb5
- MD5 b3bda0e59410084d25d403dd3f868ff9
- SHA1 91b6571b7f800492b80a292dd2538c018b3ddfe2
- SHA512 3837188d0aad5444e7cb9f0dcdeb686ebdc14358475e2efd484685b16841418e8376a352d3a4f71a50fb345a1abc992e10891e1a4f48919b38df5687dd33bd46
- SSDEEP 196608:dV5nI8TOhc19ERV0tTtPDZfgOwdC/S63gdPWBCHU:dV5nI8TOhc1GRV0tTtP1wEL3gTU
- TLSH T1E7860851B3F84229F0B3DABADAF25256D9777C525B31C19F01A4A60E1E32B918D31B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PowerISO\devcon.exe
- Size 69KB
- SHA256 8dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42
- MD5 9d199564b65a91a531b23844649459e9
- SHA1 8d84359ced1c51d14e70cb5ed36a6083c8b914cf
- SHA512 ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1
- SSDEEP 768:Ubrbmi0iAETVvlXjkQnr65WTHBAtgYSofgevxHs4gZWk:ab70GdXoQr65WDBAtgYSoflxHeW
- TLSH T1AB63DB0263E94608F1F7BB306AB552619E767C849F38C6CE018485291FF3ED0DD79BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PowerISO\setup64.exe
- Size 11KB
- SHA256 1f56046a9fa1417f6a0592bcba0e2a9699878461305caba93f04f14c9db8af60
- MD5 7d48a676e9f414f0a3c78f8d4a30d3db
- SHA1 58dc4271ca843325263c12b4cff7cb09a32a9fb3
- SHA512 04e1955b0620daef04dd71db6a17529a7792d9ca0162f1c8d72f635cfdfc5b22b62d9d5b344db5d1ffa838ac0e78b7d3e08c7b342cf6b55d79417c3ba066953c
- SSDEEP 192:qITwtvHiBYm2HW5wDV7YyxMiBNCzfMQZ0bI8KmMwUani64m/BX9n:zTwBHiBYcYV7GzkXhKmMwUaym/BX9n
- TLSH T16C322AD28E2C94E3E9868E30D1D66417BD7379C8179D60E7A160D0516AC63E07EBF13E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsf45F0.tmp
- Size 135KB
- SHA256 d01a58e0a222e4d301b75ae80150d8cbc17f56b3f6458352d2c7c449be302eee
- MD5 92eae8dec1f992db12aa23d9d55f264a
- SHA1 add6697b8c1c71980e391619e81e0bada05e38ee
- SHA512 443a12a1a49e388725ee347e650297ba5268d655acd08e623ea988cde07ae08ae861620b600fb223358339eeab926fee1c8377386501310c68a3eb9515649441
- SSDEEP 3072:hl1VSgPra4TD5Yt2JVLuPIqEjOZN7mPARacgx:hl3DtYtm+Ij2aZ
- TLSH T1DDD37C93F18550B6C9A79178CAE69A23D6B7F4141325A3DB64A08A771E03FF42F3D324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw992.tmp\InstOpt.dll
- Size 26KB
- SHA256 cc4ba9492ae9685cbd11745899303f692024bdc34ab28537f2e2dcb17dfecb98
- MD5 b06488998089cf179eb403e2f96c9055
- SHA1 59a63d9222d359843c52ad3c3bc460eff2e7b124
- SHA512 a1a43c29de86d70d6758d7eb9b57123bd58d020eb7fe0239efeeecfb007318f70756fb153e9849b587005969327f751211cb58abaad0f0ef8dcc14dbb520a0f9
- SSDEEP 384:+3Bs7jQgah7UR6QnMn/2H/D/0DHWaH3T1/kaePv6O0tTbQBYcssR:+3BsYgIfQn4/2r/0DH7H3qj0FbQBYc
- TLSH T1DBC2C6D1E3E141A2F3FB2A38B8A56B50597DBCB1A87181AAC63337095874F42DE70717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsw992.tmp\System.dll
- Size 12KB
- SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
- MD5 8cf2ac271d7679b1d68eefc1ae0c5618
- SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
- SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
- SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
- TLSH T121427D1193B089F2F590593805A67F2A6FBEAC6C27E44963CFE345853D702DFA47A243
- MD5 SHA1 SHA512 SSDEEP TLSH