Analyzing...

File Name: PowerISO7.exe

SHA1: d4b3d057dd6a741e56761b6276a456d17ec38333

MD5: 018098d17b50044a566f39117495dbed

First Seen Date: 2019-09-23 23:22:00.803535 ( 2019-09-23 23:22:00.803535 )

Number of Clients Seen: 7

Last Analysis Date: 2019-09-23 23:22:00.803535 ( 2019-09-23 23:22:00.803535 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2019-09-23 23:22:00.803535	Malware
Static Analysis Overall Verdict	2019-09-23 23:22:00.803535	No Threat Found
Dynamic Analysis Overall Verdict	2019-09-23 23:22:00.803535	No Threat Found
Precise Detectors Overall Verdict	2019-09-23 23:22:00.803535	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Suspicious
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Writes to address space of another process
Copies itself to startup
Logs user key strokes
Reads memory of another process
Opens a file in a system directory

Behavioral Information

LoadLibrary

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

ADVAPI32.dll

SHELL32.dll

propsys.dll

ntmarta.dll

t r0

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\System.dll

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\qzoxzhphgp.dll

kernel32

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\Math.dll

RichEd20

comctl32.dll

UxTheme.dll

C:\Windows\system32\ole32.dll

C:\Windows\syswow64\MSCTF.dll

OLEAUT32.DLL

IMM32.dll

C:\Windows\system32\shell32.dll

USER32.dll

ntshrui.dll

srvcli.dll

cscapi.dll

slc.dll

SHLWAPI.dll

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\InstOpt.dll

CreateProcess

CreateMutex

<NULL>

m "POWERISO_6A6EFB6A SEMAPHORE"

POWERISO_6A6EFB6A SEMAPHORE

DeleteFile

C:\Users\win7\AppData\Local\Temp\nsg6460.tmp

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp

C:\Users\win7\AppData\Local\Temp\nsv70D7.tmp

OpenMutex

Local\MSCTF.Asm.MutexDefault1

DefaultTabtip-MainUI

WriteFile

C:\Users\win7\AppData\Local\Temp\nsv70D7.tmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\PowerISO.lnk

C:\

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\Math.dll

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\InstOpt.dll

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\PowerISO Virtual Drive Manager.lnk

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\qzoxzhphgp.dll

C:\Users\win7\AppData\Local\Temp\nsg7079.tmp

C:\Users\Public\Desktop\PowerISO.lnk

C:\Users\win7\AppData\Local\Temp\nsl6480.tmp

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\modern-header.bmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\PowerISO Help.lnk

C:\Users\win7\AppData\Local\Temp\nsb6491.tmp\System.dll

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO\Uninstall PowerISO.lnk

ReadFile

C:\PowerISO7.exe

C:\Users\win7\AppData\Local\Temp\nsl6480.tmp

C:\Windows\Fonts\staticcache.dat

C:\

QueryFilePath

C:\PowerISO7.exe

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\RichEd20.DLL

C:\Windows\syswow64\MSCTF.dll

C:\Windows\syswow64\USER32.dll

OpenRegistryKey

\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Software\Microsoft\Windows\CurrentVersion\Run

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\N

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVers

CreateRegistryKey

\REGISTRY\USER\S-1-5-21-3979321414-2393373014-2172761192-1000\Software\PowerISO

\REGISTRY\USER\S-1-5-21-3979321414-23933

\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PowerISO

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Static Precise PUA Detector 1	2019-09-23 23:21:57.223193	No Match	NotDetected
Static Precise PUA Detector 4	2019-09-23 23:21:57.280651	No Match	NotDetected
Static Precise NI Detector 3	2019-09-23 23:21:57.291423	No Match	NotDetected
Static Precise PUA Detector 5	2019-09-23 23:21:57.295248	No Match	NotDetected
Static Precise Trojan Detector 1	2019-09-23 23:21:57.314601	No Match	NotDetected
Static Precise Trojan Detector 3	2019-09-23 23:21:57.314457	No Match	NotDetected
Static Precise PUA Detector 6	2019-09-23 23:21:57.334997	No Match	NotDetected
Static Precise Trojan Detector 12	2019-09-23 23:21:57.374715	No Match	NotDetected
Static Precise Virus Detector 1	2019-09-23 23:21:57.383383	No Match	NotDetected
Static Precise Virus Detector 2	2019-09-23 23:21:57.411778	No Match	NotDetected
Static Precise Trojan Detector 13	2019-09-23 23:21:57.417351	No Match	NotDetected
Static Precise PUA Detector 2	2019-09-23 23:21:57.426424	No Match	NotDetected