Overview

overview

7

Static

static

3

PAW.Setup.1.0.0.exe

windows11-21h2-x64

7

$PLUGINSDI...er.dll

windows11-21h2-x64

3

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

LICENSES.c...m.html

windows11-21h2-x64

3

PAW.exe

windows11-21h2-x64

7

d3dcompiler_47.dll

windows11-21h2-x64

1

ffmpeg.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

1

libGLESv2.dll

windows11-21h2-x64

1

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninstall PAW.exe

windows11-21h2-x64

7

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

Analysis

  • max time kernel
    900s
  • max time network
    426s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-es
  • resource tags

    arch:x64arch:x86image:win11-20260513-eslocale:es-esos:windows11-21h2-x64systemwindows
  • submitted
    21/07/2026, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PAW.exe
  • Size 164.7MB
  • Sample260721-ebrceaft7z
  • SHA256 5814e0f0e2a92d2fa40dd7d9723ad55826f29628de41850c9811d14d1c52155f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PAW.exe
    "C:\Users\Admin\AppData\Local\Temp\PAW.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Users\Admin\AppData\Local\Temp\PAW.exe
      "C:\Users\Admin\AppData\Local\Temp\PAW.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --use-gl=disabled --user-data-dir="C:\Users\Admin\AppData\Roaming\PAW" --mojo-platform-channel-handle=1936 --field-trial-handle=1944,i,1879985018582277088,11286692697390340437,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      2⤵
        PID:5228
      • C:\Users\Admin\AppData\Local\Temp\PAW.exe
        "C:\Users\Admin\AppData\Local\Temp\PAW.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\PAW" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --no-sandbox --disable-gpu-compositing --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2340 --field-trial-handle=1944,i,1879985018582277088,11286692697390340437,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Loads dropped DLL
        PID:5972

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e488e4d4-e95d-43c4-8848-9c6bb2554a66.tmp.node
          • Path C:\Users\Admin\AppData\Local\Temp\e488e4d4-e95d-43c4-8848-9c6bb2554a66.tmp.node
          • Size 1.9MB
          • SHA256 21318eda4bde917e01d03bfa7f9cc395d7d3e6f588090794b74c475301164a2c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Roaming\PAW\Network\Network Persistent State
          • Size 665B
          • SHA256 a01df777aaaaa6df395ed75c611690b08e7528e5c64d323b95ae1db9f1f9b81b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Network Persistent State~RFe591fc3.TMP
          • Path C:\Users\Admin\AppData\Roaming\PAW\Network\Network Persistent State~RFe591fc3.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH
          Submit Download