ea75ff110d4e515638b7cd4945a8b0dccbe328621ff47e78d954d0fbd54d591d

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evo-x2-cool-setup-0.6.6.exe
Size 5.0MB
Sample261104-weshbattbt
SHA256 ea75ff110d4e515638b7cd4945a8b0dccbe328621ff47e78d954d0fbd54d591d
MD5 7990abb6a0e83742d639ee4465092da4
SHA1 665598b51d980747bcbb21d4fda10336d54260bf
SHA512 8b5f837422217b8f3130162c4811496ab5c7e1f24c5c190adbfd5612db9e9ae333f128aaf7f718e1dfc557742434b483eff50a7ba4e10e29c66e95823e48c480
SSDEEP 98304:x5O0VEXMoMOB7zjHwDL7IknYRKBTnjT2ZA9tUnzNzNujOdfPC4QJdg:r0Jl7zj8L7acxmZ+eFNuUn/QI
TLSH
T1E636123FB28B653EE06A1A357A72E214583B6A6165138C1797F4C88CCF254B01E3F797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
2588	evo-x2-cool-setup-0.6.6.tmp
2012	evo-x2-cool.exe
3664	evo-x2-cool.exe
1712	evo-x2-cool-front.exe
2972	PawnIO_setup.exe
5492	evo-x2-cool.exe
4516	evo-x2-cool.exe
4596	evo-x2-cool-front.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF	PawnIO_setup.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\PawnIO.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\SET3153.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\SET3143.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\PawnIO.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\SET3154.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\SET3143.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\SET3153.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c300527f-af0c-c441-9e68-bdf8bea97d0c}\SET3154.tmp	DrvInst.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\EVO-X2-COOL\is-Z8PIRTDIKA.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\is-WXJ1WSODHR.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\is-NIISYWHXPP.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\is-HV48DIREII.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-Q9S5VWGILJ.tmp	evo-x2-cool-setup-0.6.6.tmp
File opened for modification	C:\Program Files\EVO-X2-COOL\unins000.dat	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\is-SQFAKM3A2S.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\is-3N2CNX0BCY.tmp	evo-x2-cool-setup-0.6.6.tmp
File opened for modification	C:\Program Files\PawnIO\PawnIOUtil.exe	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\is-VADK6DFJVE.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\is-EX3TVKBBTV.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-EENXVICK77.tmp	evo-x2-cool-setup-0.6.6.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-JBIEVWX2VT.tmp	evo-x2-cool-setup-0.6.6.tmp
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.dll	PawnIO_setup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.h	PawnIO_setup.exe
File created	C:\Program Files\PawnIO\uninstall.exe	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\unins000.dat	evo-x2-cool-setup-0.6.6.tmp

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIO_setup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evo-x2-cool-front.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evo-x2-cool-front.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evo-x2-cool-setup-0.6.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evo-x2-cool-setup-0.6.6.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4232-0-0x0000000000840000-0x000000000091E000-memory.dmp	innosetup
behavioral2/memory/4232-8-0x0000000000840000-0x000000000091E000-memory.dmp	innosetup
behavioral2/memory/4232-164-0x0000000000840000-0x000000000091E000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5764	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5764	taskkill.exe
Token: SeLoadDriverPrivilege	2972	PawnIO_setup.exe
Token: SeLoadDriverPrivilege	3104	DrvInst.exe
Token: SeLoadDriverPrivilege	3104	DrvInst.exe
Token: SeLoadDriverPrivilege	3104	DrvInst.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2588	evo-x2-cool-setup-0.6.6.tmp
1712	evo-x2-cool-front.exe
1712	evo-x2-cool-front.exe
1712	evo-x2-cool-front.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1712	evo-x2-cool-front.exe
1712	evo-x2-cool-front.exe
1712	evo-x2-cool-front.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 2588	4232	evo-x2-cool-setup-0.6.6.exe	89
PID 2588 wrote to memory of 5764	2588	evo-x2-cool-setup-0.6.6.tmp	90
PID 2588 wrote to memory of 2012	2588	evo-x2-cool-setup-0.6.6.tmp	93
PID 2588 wrote to memory of 3664	2588	evo-x2-cool-setup-0.6.6.tmp	95
PID 2588 wrote to memory of 2972	2588	evo-x2-cool-setup-0.6.6.tmp	100
PID 2588 wrote to memory of 5492	2588	evo-x2-cool-setup-0.6.6.tmp	106
PID 2588 wrote to memory of 4596	2588	evo-x2-cool-setup-0.6.6.tmp	109

C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.6.exe
"C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\is-J7YGW5NWJB.tmp\evo-x2-cool-setup-0.6.6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-J7YGW5NWJB.tmp\evo-x2-cool-setup-0.6.6.tmp" /SL5="$400B4,3993985,848384,C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.6.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /im evo-x2-cool-front.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- - C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\evo-x2-cool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\evo-x2-cool.exe" --entfernen
    3⤵
    - Executes dropped EXE
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\evo-x2-cool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\evo-x2-cool.exe" --stopp
    3⤵
    - Executes dropped EXE
    PID:3664
- - C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\PawnIO_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\PawnIO_setup.exe" -install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- - C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --installieren
    3⤵
    - Executes dropped EXE
    PID:5492
- - C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe"
    3⤵
    - Executes dropped EXE
    PID:4596

C:\PROGRA~1\EVO-X2~1\evo-x2-cool-front.exe
C:\PROGRA~1\EVO-X2~1\EVO-X2~2.EXE
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1712

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{957570cf-6e65-6a40-838d-5a492579f91f}\pawnio.inf" "9" "4c553107b" "00000000000000F0" "WinSta0\Default" "0000000000000168" "208" "c:\windows\temp\pawnio_04d4b741.tmp"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3380

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf" "oem1.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "00000000000000F0" "3d12"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
"C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --dienst
1⤵
- Executes dropped EXE
PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sprache-de.ini

Path C:\PROGRA~1\EVO-X2~1\sprache-de.ini
Size 10KB
SHA256 56f2d126408bad64807b1db71ce7b4a8a66ad47df585935014d02d594b884827
MD5 2a29d25e1b384c09bc97f5bb7e506d78
SHA1 252bc2783fbb8073400753e8ab11117363164430
SHA512 ee621357f11df67b7cdae2f9ee08f86ef5ad6f9b11ea2d155a764ceeae0fd3a02d4bd119cb014213e1e2add7ba01811dc45b693e846264b2e5950b5483f397a4
SSDEEP 192:tQe4FCZHsX0jzGjz2/vg6cYC4mvl0UUnE9a9MKz7S+YlbJ4H4GK:tQY5sXw+FRvl0Ua8xM78oa
TLSH
T1C822DF0227E81508B6F36FA5ADB590606B67BDE66C7DC40C11C0D24D28F1A45DA77BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evo-x2-cool-front.exe

Path C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
Size 77KB
SHA256 077d0f814721d32148de12116528b8996f2a86f2a0d35c9c6a9ee289f9bc5394
MD5 13ff9fc9eb8a9cde1cf7ea966df74e31
SHA1 6af75067caf2c1c1c9d267b845c0b8e5d966d9e7
SHA512 b806d6ccb0e96d2022ec1f83e78269531cbade954405fa3c73a3866f81e0b374cdb7a7dc39af4feeac6027f10e74db3aeb5421e95dbe4632b0c3a9f8f37a78dd
SSDEEP 1536:tbaKkMuDVcRVy4f7ol6AwbKh8alULWBFXkRo9Y2j:9aKkM8VcW4UwAwb5avBMo6
TLSH
T148736B1073D410E8F47B4778D9F25103EAB1F886473186CF1AA0D1A96E366C19E7EB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AMDFamily17.bin

Path C:\Program Files\EVO-X2-COOL\pawnio\AMDFamily17.bin
Size 10KB
SHA256 dae74615761b78bdf064dfb3e136252ddcc6fc727d88f14738d0e5800d427a91
MD5 720ae7e9b3bdc3ca2826522a819929cf
SHA1 81031241e039064ebefa756a23a2f96c37777ed8
SHA512 13f4d95309fb864f801df94ed33f4d3b57b1452a4c9a08e16d2a05722f24440dccb31a915215b5ca2c97f9cb7d18c4a28bf9d7887ef3648be672dc5e8199d592
SSDEEP 96:W5qC1d30dVz7J8jPshTe5tOCGp6i7mIz3tFUz4qPl/nTHBDUsx0:uZdM6aYz
TLSH
T16E22C446B9C1CA76C8494B730D8AD640B7B8FD178D2DAB073489B31F5EBF99CA442718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LpcACPIEC.bin

Path C:\Program Files\EVO-X2-COOL\pawnio\LpcACPIEC.bin
Size 2KB
SHA256 c38fd116e7aff4d1fdb0a494e296be0a6708e5a22fc72f14587442fb7f8f7906
MD5 5174e23ad9df4f1f0b45c8fd31b00ea4
SHA1 7cf2a364f3ca2f71dfc943953d32bf68ba4fd66b
SHA512 dda77363472d1e0fd17982e59667db409330185103ad7b1de91b1b25b0ba8f359cc2851050fc5acfe4442009a6fc6b4b8a28e1a65e592d02086beaf7b5352c2a
TLSH
T13A514426B9C18EB4CA490A370DC9C111A7B8FE06581E6F43304DBB5C8DBF49D3A41718
MD5 SHA1 SHA512 TLSH

Submit Download

einstellungen.ini

Path C:\ProgramData\evo-x2-cool\einstellungen.ini
Size 553B
SHA256 f2ecd5c8923a00ed54757134b6b280ef210f815736f22fd62ed2794df077bf5f
MD5 5f166e104a2db7cfb1a1262ca0008d5c
SHA1 14015dae00db6928d29e51f2028dd08b41acde90
SHA512 c5a64c08e03559154306900673ceaedad963e9ccdeb7558e56ae06691362cca21ad8d6494458ef51c2d2a6255426eda6ccb6902e424c7223f90e187dc4c4a950
TLSH
T1A4F026043EBD8020E1D73C3DF81A115C93E664009822B118D7496FCB191DA57C33FCAD
MD5 SHA1 SHA512 TLSH

Submit Download

einstellungen.ini

Path C:\ProgramData\evo-x2-cool\einstellungen.ini
Size 575B
SHA256 91748c18d940736bf41e010d6a37ecbc24db5f386fc99480f4727d734c1bb62b
MD5 c3d60f2774c764a21ec08327f25cbb67
SHA1 ae7ded23fe3549498829eb8734422c23b54d0937
SHA512 0da9b1824820501a418d22fdeb9b05e4f9462f46c2ac55e7b21da0553f786a888d30cbc2c3d546e8af031687ebf94512d7f153f94b9500b18fe8988a22b21807
TLSH
T175F0E1043EBD8020E1D73C3DF81A1198A3E664009822B558DB496F8B191DA57D33FCAD
MD5 SHA1 SHA512 TLSH

Submit Download

evo-x2-cool-setup-0.6.6.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-J7YGW5NWJB.tmp\evo-x2-cool-setup-0.6.6.tmp
Size 4.1MB
SHA256 7fc1c3f28c4f0d651975eceec4d06e7f2520576430a2906074c834e59cbc3592
MD5 0d0a8a22d9e332f18664de6ee22c159d
SHA1 c70868764dc9c14078f38e7a93afc0e6da4f1b6a
SHA512 b3f4be01610c0e40b9a8adf61edc6f3c4fafe930b8631f3483785738f16130305964974292ed197f9b814aa642361146679b0c4e9d8f4b1e50ca95ad31e20b01
SSDEEP 98304:d9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J33332:yItJj90Z6RgKw9
TLSH
T1FB168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\PawnIO_setup.exe
Size 3.3MB
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evo-x2-cool.exe

Path C:\Users\Admin\AppData\Local\Temp\is-OUA3UMYU50.tmp\evo-x2-cool.exe
Size 62KB
SHA256 2fdab8f40ed60afcae004f107642d0191997eee0c40b64e8d37fb6478ba207d5
MD5 c2b1a7dc8486562b9e116864c4c263de
SHA1 95a58b33ed4ee9a4a2768ad2e5ac30a199d47438
SHA512 d3b12c27937dcbf4ea8da8c963866b9137bcdf2b871a08ee79f5c7c90b0a2fe536c9027ae5758d3e5ac2fbf8117f079604e4d244c7fd55befa053e9d416fcd60
SSDEEP 1536:Y5uVXje8O+XVSHVu6PIHT45VwEUSab00OBFXkRo:iYV0VxAz45c/b00OBMo
TLSH
T1D2538C0073E814E5D576A238E5731613F8B1F9165322AADF07E1C6681E276C0AE7BB87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pawnio.inf_amd64_a72a2f969b8b7496.ini

Path C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini
Size 413B
SHA256 fc8aa4a579d2afc40ab139ff39286fb2c9f97b6548fd85dda1cf831becd7b2ef
MD5 fb571234e6576c1ccf3fd0cb95f1b754
SHA1 4ff3b50d9c553d36ad76b01db063649021c5f623
SHA512 50dc008e92cb9c3a88c893334131a139e199cc5df4548105a2b61955c5e57b89d551b23396aafb727ec4ed2682c588d171a8f77f3369b1a6ad33509f93bbb59a
TLSH
T17EE09253002A11DFC3084643033C5A6B8647F26D44632DDDB342FDE43602DA25E55732
MD5 SHA1 SHA512 TLSH

Submit Download

pawnio.cat

Path C:\Windows\Temp\PAWNIO~1.TMP\pawnio.cat
Size 11KB
SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
MD5 8045cc5d557423c7cef1ddc814abe8a3
SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
TLSH
T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO.inf

Path C:\Windows\Temp\PawnIO_04D4B741.tmp\PawnIO.inf
Size 1KB
SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
MD5 0a33770fb7ac5bdf673e6d1bb78adc61
SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
TLSH
T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.sys

Path C:\Windows\Temp\PawnIO_04D4B741.tmp\PawnIO.sys
Size 133KB
SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
MD5 a9ebaa64ddefba4f4ad3b3071c582a24
SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
TLSH
T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2588-12-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-72-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-70-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-131-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-9-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-10-0x0000000001630000-0x0000000001631000-memory.dmp

Download

memory/2588-162-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-163-0x00000000008B0000-0x0000000000CE9000-memory.dmp

Download

memory/2588-6-0x0000000001630000-0x0000000001631000-memory.dmp

Download

memory/4232-0-0x0000000000840000-0x000000000091E000-memory.dmp

Download

memory/4232-8-0x0000000000840000-0x000000000091E000-memory.dmp

Download

memory/4232-164-0x0000000000840000-0x000000000091E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads