c169b66653d80c51c1cada68a7713dcaf9cb8e6886c6a4e0d6a5b5586eec4b38

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evo-x2-cool-setup-0.6.7.exe
Size 5.0MB
Sample261104-weq99attbs
SHA256 c169b66653d80c51c1cada68a7713dcaf9cb8e6886c6a4e0d6a5b5586eec4b38
MD5 f0853bf0ac27aaa5c232a048e29e21c3
SHA1 bed4fdaee1b565fda4a9963a24e8bd856ec9d788
SHA512 4a0525c7a7a7021ef77a6478ceef27883588aebf85d4e0ff280e59246aac81eba1f876d2c77b757b8811146094b748624a1d0b81d7e5715255bcc684aac5f05b
SSDEEP 98304:x5OHV+lnZIbwNaIjItyyouKiaBlaMM2059SznidCvfE/WiBC4QJdU:rYV+BZIbNIj8Gv2y06LHv8OiB/QM
TLSH
T1C836123FB28B653EE06A1A357A76E214583BAA61A1134C46D7F4C84CCF254B01E3F797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
5960	evo-x2-cool-setup-0.6.7.tmp
1600	evo-x2-cool.exe
1096	evo-x2-cool.exe
3516	PawnIO_setup.exe
4884	evo-x2-cool-front.exe
2524	evo-x2-cool.exe
4268	evo-x2-cool.exe
4600	evo-x2-cool-front.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\SET2FB9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\SET2FB7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\SET2FB8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF	PawnIO_setup.exe
File created	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\SET2FB7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\SET2FB8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\PawnIO.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{256bd2be-a311-1243-be41-b286fe05a621}\SET2FB9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf	DrvInst.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-71PFMLYRGQ.tmp	evo-x2-cool-setup-0.6.7.tmp
File opened for modification	C:\Program Files\EVO-X2-COOL\unins000.dat	evo-x2-cool-setup-0.6.7.tmp
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.h	PawnIO_setup.exe
File created	C:\Program Files\PawnIO\uninstall.exe	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\is-J0WSLXW5KS.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\is-CCO1SSONSI.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\is-YKU7FOWSCG.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\is-V2MRE27B2I.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-QB2ONCACIJ.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\unins000.dat	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\is-O2NMKNFK1V.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\is-LG7ZMWX7BI.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-OEVFHA3790.tmp	evo-x2-cool-setup-0.6.7.tmp
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.dll	PawnIO_setup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOUtil.exe	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\is-6GRUW6U6LF.tmp	evo-x2-cool-setup-0.6.7.tmp
File created	C:\Program Files\EVO-X2-COOL\is-R5XEQ8D7JG.tmp	evo-x2-cool-setup-0.6.7.tmp

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIO_setup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evo-x2-cool-front.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evo-x2-cool-front.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evo-x2-cool-setup-0.6.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evo-x2-cool-setup-0.6.7.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/236-1-0x0000000000BA0000-0x0000000000C7E000-memory.dmp	innosetup
behavioral2/memory/236-8-0x0000000000BA0000-0x0000000000C7E000-memory.dmp	innosetup
behavioral2/memory/236-174-0x0000000000BA0000-0x0000000000C7E000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PawnIO_setup.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3108	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3108	taskkill.exe
Token: SeLoadDriverPrivilege	3516	PawnIO_setup.exe
Token: SeLoadDriverPrivilege	2568	DrvInst.exe
Token: SeLoadDriverPrivilege	2568	DrvInst.exe
Token: SeLoadDriverPrivilege	2568	DrvInst.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5960	evo-x2-cool-setup-0.6.7.tmp
4884	evo-x2-cool-front.exe
4884	evo-x2-cool-front.exe
4884	evo-x2-cool-front.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4884	evo-x2-cool-front.exe
4884	evo-x2-cool-front.exe
4884	evo-x2-cool-front.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 236 wrote to memory of 5960	236	evo-x2-cool-setup-0.6.7.exe	88
PID 5960 wrote to memory of 3108	5960	evo-x2-cool-setup-0.6.7.tmp	89
PID 5960 wrote to memory of 1600	5960	evo-x2-cool-setup-0.6.7.tmp	92
PID 5960 wrote to memory of 1096	5960	evo-x2-cool-setup-0.6.7.tmp	94
PID 5960 wrote to memory of 3516	5960	evo-x2-cool-setup-0.6.7.tmp	98
PID 5960 wrote to memory of 2524	5960	evo-x2-cool-setup-0.6.7.tmp	105
PID 5960 wrote to memory of 4600	5960	evo-x2-cool-setup-0.6.7.tmp	108

C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.7.exe
"C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:236
- C:\Users\Admin\AppData\Local\Temp\is-3WR85ZGI52.tmp\evo-x2-cool-setup-0.6.7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3WR85ZGI52.tmp\evo-x2-cool-setup-0.6.7.tmp" /SL5="$400AA,3999053,848384,C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.7.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5960
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /im evo-x2-cool-front.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\evo-x2-cool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\evo-x2-cool.exe" --entfernen
    3⤵
    - Executes dropped EXE
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\evo-x2-cool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\evo-x2-cool.exe" --stopp
    3⤵
    - Executes dropped EXE
    PID:1096
- - C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\PawnIO_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\PawnIO_setup.exe" -install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- - C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --installieren
    3⤵
    - Executes dropped EXE
    PID:2524
- - C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe"
    3⤵
    - Executes dropped EXE
    PID:4600

C:\PROGRA~1\EVO-X2~1\evo-x2-cool-front.exe
C:\PROGRA~1\EVO-X2~1\EVO-X2~2.EXE
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4884

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{54c67259-20d3-ea41-9532-2ab0ed6a20b8}\pawnio.inf" "9" "4c553107b" "0000000000000190" "WinSta0\Default" "0000000000000138" "208" "c:\windows\temp\pawnio_700110d1.tmp"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5920

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf" "oem1.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000198" "b192"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
"C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --dienst
1⤵
- Executes dropped EXE
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sprache-de.ini

Path C:\PROGRA~1\EVO-X2~1\sprache-de.ini
Size 11KB
SHA256 fc2a394b8c9afd33fd53037c0553dfb89ca97e5e2b03d3c584b765315de04ff7
MD5 271c4110204188b4614c93e3b6cb59ec
SHA1 ac360b010d188b3fe33e381a2897f874a13fc215
SHA512 3b68c78d0870e6bd59cb2f67390b4b0b25260e0a0c4eadec8a62af4b946adfcb4df56283a22f9f2a32da9cae97c3d64049ab388da3a2a75d27c371cfc8bc673c
SSDEEP 192:tQe4CCZHsXyjzGjz2/vg6ZDDYC4mvl05UnEh2MwKS+YlbJFYH4GrUcDL:tQV5sXiDFRvl05aOwK8VY713
TLSH
T1B432F10227E80508B6F26FA5EDB590606B67BEE66C7DC40C12C0D64D28F1A45DA37BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evo-x2-cool-front.exe

Path C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
Size 87KB
SHA256 5445ceb49d7b567d9a50e9b92607efb7ece1492dcf402b65f5c05f98f870a3c9
MD5 e73c4095c4d745f9633b52a994ef3463
SHA1 a50522ff42342fe8d00e8078bae8d7b2798f8f14
SHA512 af079a39bc20328a72e6f0b636aa053007fb95e51bec92a5595fa4748830e9bbec60b6fc9116b49ccbc0078eb4a2bd797d467be9dba8dad83108feb463526a89
SSDEEP 1536:57xoxHik1MVEooU7VpGhJaQ/pGFLBFXkRo9Y2j:57xoixVvN7V49/OBMo6
TLSH
T1BD935A1033D451E8F47A4775E9B62503EB31B9A68B3097CF0254C0692F327C5AE7ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AMDFamily17.bin

Path C:\Program Files\EVO-X2-COOL\pawnio\AMDFamily17.bin
Size 10KB
SHA256 dae74615761b78bdf064dfb3e136252ddcc6fc727d88f14738d0e5800d427a91
MD5 720ae7e9b3bdc3ca2826522a819929cf
SHA1 81031241e039064ebefa756a23a2f96c37777ed8
SHA512 13f4d95309fb864f801df94ed33f4d3b57b1452a4c9a08e16d2a05722f24440dccb31a915215b5ca2c97f9cb7d18c4a28bf9d7887ef3648be672dc5e8199d592
SSDEEP 96:W5qC1d30dVz7J8jPshTe5tOCGp6i7mIz3tFUz4qPl/nTHBDUsx0:uZdM6aYz
TLSH
T16E22C446B9C1CA76C8494B730D8AD640B7B8FD178D2DAB073489B31F5EBF99CA442718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LpcACPIEC.bin

Path C:\Program Files\EVO-X2-COOL\pawnio\LpcACPIEC.bin
Size 2KB
SHA256 c38fd116e7aff4d1fdb0a494e296be0a6708e5a22fc72f14587442fb7f8f7906
MD5 5174e23ad9df4f1f0b45c8fd31b00ea4
SHA1 7cf2a364f3ca2f71dfc943953d32bf68ba4fd66b
SHA512 dda77363472d1e0fd17982e59667db409330185103ad7b1de91b1b25b0ba8f359cc2851050fc5acfe4442009a6fc6b4b8a28e1a65e592d02086beaf7b5352c2a
TLSH
T13A514426B9C18EB4CA490A370DC9C111A7B8FE06581E6F43304DBB5C8DBF49D3A41718
MD5 SHA1 SHA512 TLSH

Submit Download

einstellungen.ini

Path C:\ProgramData\evo-x2-cool\einstellungen.ini
Size 553B
SHA256 f2ecd5c8923a00ed54757134b6b280ef210f815736f22fd62ed2794df077bf5f
MD5 5f166e104a2db7cfb1a1262ca0008d5c
SHA1 14015dae00db6928d29e51f2028dd08b41acde90
SHA512 c5a64c08e03559154306900673ceaedad963e9ccdeb7558e56ae06691362cca21ad8d6494458ef51c2d2a6255426eda6ccb6902e424c7223f90e187dc4c4a950
TLSH
T1A4F026043EBD8020E1D73C3DF81A115C93E664009822B118D7496FCB191DA57C33FCAD
MD5 SHA1 SHA512 TLSH

Submit Download

einstellungen.ini

Path C:\ProgramData\evo-x2-cool\einstellungen.ini
Size 575B
SHA256 91748c18d940736bf41e010d6a37ecbc24db5f386fc99480f4727d734c1bb62b
MD5 c3d60f2774c764a21ec08327f25cbb67
SHA1 ae7ded23fe3549498829eb8734422c23b54d0937
SHA512 0da9b1824820501a418d22fdeb9b05e4f9462f46c2ac55e7b21da0553f786a888d30cbc2c3d546e8af031687ebf94512d7f153f94b9500b18fe8988a22b21807
TLSH
T175F0E1043EBD8020E1D73C3DF81A1198A3E664009822B558DB496F8B191DA57D33FCAD
MD5 SHA1 SHA512 TLSH

Submit Download

evo-x2-cool-setup-0.6.7.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3WR85ZGI52.tmp\evo-x2-cool-setup-0.6.7.tmp
Size 4.1MB
SHA256 81f9b1dd1b4e4b8d7f3a2511fd44589fc39032f7f4c2033d442be3aa1c5bb85c
MD5 6164a9fec209a5facedd70532c1e5375
SHA1 8a3f08fd61366ba9bba7d63e0e18a329a1ac5033
SHA512 5678252c4e164140f095608012c865ce59cb8de388fc1594f7c91fccf47c5973e89e0d5876ccacad11060e0615544933aef8b2a2298f64fade23fff0e4535d94
SSDEEP 98304:d9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J3333B:yItJj90Z6RgKwy
TLSH
T199168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\PawnIO_setup.exe
Size 3.3MB
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evo-x2-cool.exe

Path C:\Users\Admin\AppData\Local\Temp\is-J7SP5R2V6U.tmp\evo-x2-cool.exe
Size 63KB
SHA256 80142d3ce2446bce20acc7c22b725d76e37191450a18a10fb5f31716cc42d46c
MD5 6d001b03c169931854ae6e63efc6958d
SHA1 496390ab553d24921e2b6f3f447421a6b7878120
SHA512 9d535702ad0e3082e7b014e8fa4d9f3533cacb9d2d903646a1eaebf5b9e82c2376978d6f7160f9b510664b124b1c8b854fccc20b91c88ce0f514ebdd34e99144
SSDEEP 1536:nUb3GKJTjqrUS+prbpvBIpt3ckvhYoRExdS66OFBFXkRo:nUPqZ+1BWD3c4hKf6OFBMo
TLSH
T168539D00B3D514E5D5329238E5B71613F4B1B819133256CF47E1E76D2F26AC0AEBAB87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

anzeige.txt

Path C:\Users\Admin\AppData\Local\evo-x2-cool\anzeige.txt
Size 137B
SHA256 20596887347810025526cdd143140c48d76636f228aa4d727eb7aac1260ce224
MD5 ad886f27b59a41b84196a41dbae8144d
SHA1 a5d3fa53380bcd47f94e2d206e29480272020243
SHA512 cebdd672d59d720cb877568a1ae14af68acbcc06bce8d325d42bad3f9e8b23d0fa0590128beda9eb8d2db36d253e6af0a8be319fe858cc83bba462154cbf09b9
TLSH
T171C02B1300C000BFFB2804328334A7168103D0AC50244CFC3D53EDD42430C173C30040
MD5 SHA1 SHA512 TLSH

Submit Download

pawnio.inf_amd64_a72a2f969b8b7496.ini

Path C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini
Size 413B
SHA256 84cb42f989fe3a55423ad36c903d1393518d3e61bc14a5f597deea05da308c45
MD5 1c24a707d69a9807712dc0d2a53aa953
SHA1 8053ea00710dc725a56d4b5812242b0f51d22148
SHA512 d18338ca453513643458bf9efc396c7a88ce82588ce1c9297035f528c95faa9d7c3b008055b86a3f59d0f143557160c037c5e568df051891d23a181507ddbdaf
TLSH
T12BE09253012519DFCB0945C3023E7F7A864FB16D44613DDDB240EDA43603D697F66532
MD5 SHA1 SHA512 TLSH

Submit Download

pawnio.cat

Path C:\Windows\Temp\PAWNIO~1.TMP\pawnio.cat
Size 11KB
SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
MD5 8045cc5d557423c7cef1ddc814abe8a3
SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
TLSH
T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO.inf

Path C:\Windows\Temp\PawnIO_700110D1.tmp\PawnIO.inf
Size 1KB
SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
MD5 0a33770fb7ac5bdf673e6d1bb78adc61
SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
TLSH
T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.sys

Path C:\Windows\Temp\PawnIO_700110D1.tmp\PawnIO.sys
Size 133KB
SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
MD5 a9ebaa64ddefba4f4ad3b3071c582a24
SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
TLSH
T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-174-0x0000000000BA0000-0x0000000000C7E000-memory.dmp

Download

memory/236-8-0x0000000000BA0000-0x0000000000C7E000-memory.dmp

Download

memory/236-1-0x0000000000BA0000-0x0000000000C7E000-memory.dmp

Download

memory/5960-78-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-93-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-80-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-75-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-9-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-10-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/5960-73-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-169-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-71-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-12-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-173-0x00000000009F0000-0x0000000000E29000-memory.dmp

Download

memory/5960-6-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads