Overview
overview
10Static
static
3tmpanfn5x1c.exe
windows10-2004-x64
8tmpanfn5x1c.exe
windows11-21h2-x64
6ADVPACK.dll
windows10-2004-x64
3ADVPACK.dll
windows11-21h2-x64
3W95INF16.dll
windows10-2004-x64
1W95INF16.dll
windows11-21h2-x64
1W95INF32.dll
windows10-2004-x64
3W95INF32.dll
windows11-21h2-x64
3fngrprnt.dll
windows10-2004-x64
3fngrprnt.dll
windows11-21h2-x64
3msnphoto.scr
windows10-2004-x64
3msnphoto.scr
windows11-21h2-x64
3msvcr71.dll
windows10-2004-x64
3msvcr71.dll
windows11-21h2-x64
3pibase.dll
windows10-2004-x64
3pibase.dll
windows11-21h2-x64
3pidav.dll
windows10-2004-x64
3pidav.dll
windows11-21h2-x64
3piorg.dll
windows10-2004-x64
3piorg.dll
windows11-21h2-x64
3piorgres.dll
windows10-2004-x64
1piorgres.dll
windows11-21h2-x64
1pisync.dll
windows10-2004-x64
3pisync.dll
windows11-21h2-x64
3pisynctw.exe
windows10-2004-x64
3pisynctw.exe
windows11-21h2-x64
3piview.dll
windows10-2004-x64
3piview.dll
windows11-21h2-x64
3slides~1.js
windows10-2004-x64
10slides~1.js
windows11-21h2-x64
10startup.js
windows10-2004-x64
3startup.js
windows11-21h2-x64
3Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
tmpanfn5x1c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
tmpanfn5x1c.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
ADVPACK.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
ADVPACK.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
W95INF16.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
W95INF16.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
W95INF32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
W95INF32.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
fngrprnt.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
fngrprnt.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
msnphoto.scr
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
msnphoto.scr
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
msvcr71.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
msvcr71.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
pibase.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
pibase.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
pidav.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
pidav.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
piorg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
piorg.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
piorgres.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
piorgres.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
pisync.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
pisync.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
pisynctw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
pisynctw.exe
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
piview.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
piview.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
slides~1.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
slides~1.js
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
startup.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
startup.js
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target piorg.dll
- Size 422KB
- Sample260523-b32exacy41
- SHA256 81b9f877f9198a761f820a0ea2b02eb3db85750011e50997560391dc2f160c64
- MD5 d433efe19fd0d9b896945f34ba839698
- SHA1 ade6c8c2732fd18308b512986a485dff40a70774
- SHA512 97d2d2ceba05339a830ee5ad2a1dd9667dbf7dc17b5bf4509eb72c8c6a45214756539bab2a4e7d6a663ba67a9de73878e82e7582240e3a5f76bdb1ab8bc0324f
- SSDEEP 12288:ZcqDvHI2ibCwvkqzcHKd6D/Galxp+814:aqDvHIfbCwZ4HKdQ/Gee81
- TLSH T1EA947D22B7E1C231C2A340308F1AEFE9A6BAF6A44D24990733550B5E5F7556CE63D70B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache\CLSID\ = "{6AA36298-AF5F-42fc-9957-417E01141D52}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\AppID = "{A4C28B76-DFB6-4797-8E91-BDA23E8ED7FC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer.1\CLSID\ = "{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\ProgID\ = "PIOrganize.HIPPhotoExplorer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\ = "CHIPEmptyVolumeCache Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\VersionIndependentProgID\ = "PIOrganize.HIPPhotoExplorer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\ProgID\ = "PIOrganize.MsnPubSend.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\AppID = "{A4C28B76-DFB6-4797-8E91-BDA23E8ED7FC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\TypeLib\ = "{729BB3D4-7ECB-4A21-BCAC-BB0A52B44838}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache.1\ = "CHIPEmptyVolumeCache Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\ = "HIPPhotoExplorer Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend.1\CLSID\ = "{D1E5FD88-3953-4780-8F30-3FA2EC573425}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\piorg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache\CurVer\ = "PIOrganize.CHIPEmptyVolumeCache.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer\CLSID\ = "{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\ = "MsnPubSend Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend\CurVer\ = "PIOrganize.MsnPubSend.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\VersionIndependentProgID\ = "PIOrganize.MsnPubSend" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\VersionIndependentProgID\ = "PIOrganize.CHIPEmptyVolumeCache" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\piorg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend.1\ = "MsnPubSend Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\TypeLib\ = "{729BB3D4-7ECB-4A21-BCAC-BB0A52B44838}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PIOrganize.DLL regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache\ = "CHIPEmptyVolumeCache Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A4C28B76-DFB6-4797-8E91-BDA23E8ED7FC}\ = "PIOrganize" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer.1\ = "HIPPhotoExplorer Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Implemented Categories\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.CHIPEmptyVolumeCache.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer\CurVer\ = "PIOrganize.HIPPhotoExplorer.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.HIPPhotoExplorer\ = "HIPPhotoExplorer Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PIOrganize.MsnPubSend\CLSID\ = "{D1E5FD88-3953-4780-8F30-3FA2EC573425}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\ProgID\ = "PIOrganize.CHIPEmptyVolumeCache.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AA36298-AF5F-42fc-9957-417E01141D52}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\piorg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0A03AD0-F49C-4e01-9C1D-CA3B7B73B08E}\AppID = "{A4C28B76-DFB6-4797-8E91-BDA23E8ED7FC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E5FD88-3953-4780-8F30-3FA2EC573425}\InprocServer32\ThreadingModel = "Both" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4608 wrote to memory of 2680 4608 regsvr32.exe 80
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\piorg.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\piorg.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2680
-