Overview
overview
6Static
static
3PawnIOSetup.exe
windows10-2004-x64
1PawnIOSetup.exe
windows11-ltsc_2024-x64
1README.pdf
windows10-2004-x64
3README.pdf
windows11-ltsc_2024-x64
3gnwinfo.exe
windows10-2004-x64
6gnwinfo.exe
windows11-ltsc_2024-x64
6gnwinfox86.exe
windows10-2004-x64
6gnwinfox86.exe
windows11-ltsc_2024-x64
6hw_report.ps1
windows10-2004-x64
6hw_report.ps1
windows11-ltsc_2024-x64
6libcdi.dll
windows10-2004-x64
1libcdi.dll
windows11-ltsc_2024-x64
1libcdix86.dll
windows10-2004-x64
3libcdix86.dll
windows11-ltsc_2024-x64
3nwinfo.exe
windows10-2004-x64
5nwinfo.exe
windows11-ltsc_2024-x64
5nwinfox86.exe
windows10-2004-x64
3nwinfox86.exe
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 17:13
Behavioral task
behavioral1
Sample
PawnIOSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
PawnIOSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
README.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
README.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
gnwinfo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
gnwinfo.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
gnwinfox86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
gnwinfox86.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
hw_report.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
hw_report.ps1
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
libcdi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
libcdi.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
libcdix86.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libcdix86.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
nwinfo.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
nwinfo.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
nwinfox86.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
nwinfox86.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target gnwinfox86.exe
- Size 1.0MB
- Sample260803-vrf5datfna
- SHA256 e6fea9d2ffeaeb7b0593fe065f6b37fe68ba2cab66b95ed1eb7f26c3f75acce6
- MD5 2e83dc6fa773fcf2b9691cbffbe73fd3
- SHA1 e03bfbef852f17ecc8620212cede4166189fae7c
- SHA512 0b82b5db505adb732a030f769751b1f0580feed4e382749e9fb3172dc2bd2403a965cf2090e7d64dd99cc6fb365a04ccf3fdacc34c310eae77a76c795b9fd2f5
- SSDEEP 24576:BmaPUM+CU2z7HfCoFSBgYNS/KtT48WRIoFEz:oaG2z7HfCWKk/KF4REz
- TLSH T13735BF90B621C5BAD89101716DE7A3EB69287E7C1F5252DFF3C076AC11B00E217B9B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gnwinfox86.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: gnwinfox86.exe File opened (read-only) \??\W: gnwinfox86.exe File opened (read-only) \??\X: gnwinfox86.exe File opened (read-only) \??\Z: gnwinfox86.exe File opened (read-only) \??\B: gnwinfox86.exe File opened (read-only) \??\G: gnwinfox86.exe File opened (read-only) \??\L: gnwinfox86.exe File opened (read-only) \??\M: gnwinfox86.exe File opened (read-only) \??\P: gnwinfox86.exe File opened (read-only) \??\Y: gnwinfox86.exe File opened (read-only) \??\A: gnwinfox86.exe File opened (read-only) \??\E: gnwinfox86.exe File opened (read-only) \??\H: gnwinfox86.exe File opened (read-only) \??\I: gnwinfox86.exe File opened (read-only) \??\J: gnwinfox86.exe File opened (read-only) \??\O: gnwinfox86.exe File opened (read-only) \??\K: gnwinfox86.exe File opened (read-only) \??\Q: gnwinfox86.exe File opened (read-only) \??\T: gnwinfox86.exe File opened (read-only) \??\V: gnwinfox86.exe File opened (read-only) \??\N: gnwinfox86.exe File opened (read-only) \??\R: gnwinfox86.exe File opened (read-only) \??\S: gnwinfox86.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 gnwinfox86.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gnwinfox86.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 gnwinfox86.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID gnwinfox86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 gnwinfox86.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID gnwinfox86.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName gnwinfox86.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName gnwinfox86.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz gnwinfox86.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 gnwinfox86.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 1064 gnwinfox86.exe Token: SeLoadDriverPrivilege 1064 gnwinfox86.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe 1064 gnwinfox86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gnwinfox86.exe"C:\Users\Admin\AppData\Local\Temp\gnwinfox86.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1064