ccd2a555086807036319d261e43855685fa0e009ed808a035fd189d9d6929d4c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nwinfo.exe
Size 848KB
Sample260803-vrf5datfna
SHA256 ccd2a555086807036319d261e43855685fa0e009ed808a035fd189d9d6929d4c
MD5 b3632b9a8737fb65c87270ca79b880ad
SHA1 7623c50c16f2f6f923b41f44baec4caebbe7e00b
SHA512 67811d504375947c4d3da532d50e426a58344bd4f2484d22d1baf7a190cba3989dd27f796e36701bbb4e3755eca4f938a7b417f011c41526c7959923286d4c85
SSDEEP 12288:tm37zPooHSnWoZVMIqnIOTewqz+qoKH4lqbxQt:tm37zPooHSnWPTebz+qo24ld
TLSH
T174058D4AB76589F5C8678139CD839163EAB1BC082F6157E77990B66C3F730E61E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\SETD2E7.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF	PawnIOSetup.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\SETD2E6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\SETD2E7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\PawnIO.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\SETD2E8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\SETD2E8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}\SETD2E6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{dcaf351c-2188-7a41-a46d-f91aba78db4b}	DrvInst.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.h	PawnIOSetup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.dll	PawnIOSetup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOUtil.exe	PawnIOSetup.exe
File created	C:\Program Files\PawnIO\uninstall.exe	PawnIOSetup.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIOSetup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIOSetup.exe

Checks SCSI registry key(s) 3 TTPs 44 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	PawnIOSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	PawnIOSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	PawnIOSetup.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	1120	nwinfo.exe
Token: SeLoadDriverPrivilege	1120	nwinfo.exe
Token: SeLoadDriverPrivilege	4960	PawnIOSetup.exe
Token: SeLoadDriverPrivilege	5684	DrvInst.exe
Token: SeLoadDriverPrivilege	5684	DrvInst.exe
Token: SeLoadDriverPrivilege	5684	DrvInst.exe
Token: SeLoadDriverPrivilege	1500	PawnIOSetup.exe
Token: SeLoadDriverPrivilege	1500	PawnIOSetup.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4960	1120	nwinfo.exe	91
PID 1120 wrote to memory of 1500	1120	nwinfo.exe	96

C:\Users\Admin\AppData\Local\Temp\nwinfo.exe
"C:\Users\Admin\AppData\Local\Temp\nwinfo.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\PawnIOSetup.exe
  PawnIOSetup.exe -install -silent
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Users\Admin\AppData\Local\Temp\PawnIOSetup.exe
  PawnIOSetup.exe -uninstall -silent
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1500

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2e63d688-b1ab-864d-8d28-b5e1558ae32c}\pawnio.inf" "9" "4c553107b" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\windows\temp\pawnio_2a31603a.tmp"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2896

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf" "oem1.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000178" "968b"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PawnIOLib.dll

Path C:\Program Files\PawnIO\PawnIOLib.dll
Size 38KB
SHA256 d71f62627d66983bb9f5b1c269f27bcd8c1b8a46e794377a6330f84c198f4443
MD5 ab63195d7f5d470d39284cbee5bd57f7
SHA1 f438797c5724e7142264697072f6ae7f161dabc6
SHA512 9c007911a6ee4c800a98883ee44de1dc78a879048c93b415d114f3095d386fa83fb5d10edda0e025e0b821612c528444b136b40e35a6ca8aaa508bb373e702ed
SSDEEP 384:kmbKFNL+YuMHvWcbAPZr0YLShbjdAA1m5wMPU5uEuo+:krFNLic+cbgfShbxf1mlP5EB+
TLSH
T1A4037C9B8104528BEDA7DEB482CBDA1FBC3877432B6105EBA1D9C0581D41BC5B33667A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIOLib.h

Path C:\Program Files\PawnIO\PawnIOLib.h
Size 4KB
SHA256 307e64aa72e30fb9e0b9c637390a035d691e306be8a0048b30a94904e8e52726
MD5 49806e372ac9298c0945cf10af49a4d7
SHA1 23c2db9744752cd72ab283d3a9892c193fffcaf7
SHA512 e20d81c21f3271aa7b45b6ae32ccb58ca6ea90637c7133361632132d75650a9d9c236597cf22d4ba9e5d1caf00dee2d66d8e75db7459947bf8ea969e47e3406c
SSDEEP 48:22dJyRhdr1/Qnv/nJQn0Q4pECqGn+d3qGn+IqGn+bQBFLTpEyqGncKjqGn68ssBF:HJyRbJKvuduIubOFj4nSeo
TLSH
T1FA91FEA9851701BFBE3974D165BA94E3536A0FA3D24387C2F1FC4F653928022D2976CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIOUtil.exe

Path C:\Program Files\PawnIO\PawnIOUtil.exe
Size 308KB
SHA256 8f26e2e55df2faffda3988d915e7fde769e011eae854d981dccfece3efbca1bc
MD5 ceeae5fa19ad0c320b56f7d897dcf788
SHA1 e3993cbfed20d8fa68c2cf81529a59487e498d29
SHA512 249a09579173b8a4c2aaa009cbda1ad6fd5a21691502232e0db2be5ece27a08e3043ce6bd3175caf63df809a002285b1dda39f2478eeec9495fd3f2a56f554ed
SSDEEP 3072:hmophLOjtksJn5Odvm64vNtVvVsbvk1Z1fs93f758+Ewzr8ewAfKpYjpSaxBV:1ORkWn5ORmvR9MLP75dBmUn
TLSH
T1F2647D55B3A40CF9EDB7823EC9524506DA727C065760E7CF03A0469A2F277E05E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\PawnIO\uninstall.exe
Size 3.3MB
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO.inf

Path C:\Windows\Temp\PawnIO_2A31603A.tmp\PawnIO.inf
Size 1KB
SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
MD5 0a33770fb7ac5bdf673e6d1bb78adc61
SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
TLSH
T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.sys

Path C:\Windows\Temp\PawnIO_2A31603A.tmp\PawnIO.sys
Size 133KB
SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
MD5 a9ebaa64ddefba4f4ad3b3071c582a24
SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
TLSH
T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pawnio.cat

Path C:\Windows\Temp\PawnIO_2A31603A.tmp\pawnio.cat
Size 11KB
SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
MD5 8045cc5d557423c7cef1ddc814abe8a3
SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
TLSH
T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads