8633b94d7e5e663d8fef70dac575be326db9aeabefc9a5b75ed3953d07e05883

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
evo-x2-cool-setup-0.6.3.exe
Size 5.0MB
Sample261104-wezavset6m
SHA256 8633b94d7e5e663d8fef70dac575be326db9aeabefc9a5b75ed3953d07e05883
MD5 27630d1a5fd9900b5d670d11ac9a0779
SHA1 40108c883c76e0962f70460c0d0158614d74a910
SHA512 ecdd74ef88caa4c7dc54c4e7273518b774d1bc78af61e79938f4d0844eaa642f9c366bde8a77e3bdd439b4caf68f2ec11e5be282616171df24d88e810d2c29e8
SSDEEP 98304:x5OHOhgHEbhwbTwuWImbTAeBdeEg2+q93VngQ2IAWBiC4QJdB:rc7HQhw4uWTBqm+CNKINg/Qp
TLSH
T18136123FB28B653EE06E1A397A76E214483B6A6165168C47D7F4C84CCF250B01E3F697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4920	evo-x2-cool-setup-0.6.3.tmp
3076	evo-x2-cool.exe
5048	evo-x2-cool.exe
5208	evo-x2-cool-front.exe
1412	PawnIO_setup.exe
700	evo-x2-cool.exe
5744	evo-x2-cool.exe
2032	evo-x2-cool-front.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\SET301A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\SET301B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\SET301C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\SET301C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\PawnIO.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\PawnIO.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\SET301B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4ad9f44e-e4e5-4d4e-9593-40bf47acc0f2}\SET301A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF	PawnIO_setup.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\EVO-X2-COOL\is-H70QIQ93QN.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\unins000.dat	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\is-EL7S4CV1M1.tmp	evo-x2-cool-setup-0.6.3.tmp
File opened for modification	C:\Program Files\EVO-X2-COOL\unins000.dat	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\PawnIO\uninstall.exe	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\is-U2WE537JMC.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\is-RZBY0UXYXC.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-43EV4GF32P.tmp	evo-x2-cool-setup-0.6.3.tmp
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.h	PawnIO_setup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOUtil.exe	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\is-8JIHXZTN12.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\is-1TNFSWQ98F.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\is-A7DR5MY0EW.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-HM5GFIE1E7.tmp	evo-x2-cool-setup-0.6.3.tmp
File created	C:\Program Files\EVO-X2-COOL\pawnio\is-3O3VOQB1OF.tmp	evo-x2-cool-setup-0.6.3.tmp
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.dll	PawnIO_setup.exe
File created	C:\Program Files\EVO-X2-COOL\is-SITFAU4NW5.tmp	evo-x2-cool-setup-0.6.3.tmp

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIO_setup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	evo-x2-cool-front.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	evo-x2-cool-front.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evo-x2-cool-setup-0.6.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evo-x2-cool-setup-0.6.3.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2984-0-0x0000000000F80000-0x000000000105E000-memory.dmp	innosetup
behavioral2/memory/2984-8-0x0000000000F80000-0x000000000105E000-memory.dmp	innosetup
behavioral2/memory/2984-159-0x0000000000F80000-0x000000000105E000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PawnIO_setup.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3348	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	taskkill.exe
Token: SeLoadDriverPrivilege	1412	PawnIO_setup.exe
Token: SeLoadDriverPrivilege	1744	DrvInst.exe
Token: SeLoadDriverPrivilege	1744	DrvInst.exe
Token: SeLoadDriverPrivilege	1744	DrvInst.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4920	evo-x2-cool-setup-0.6.3.tmp
5208	evo-x2-cool-front.exe
5208	evo-x2-cool-front.exe
5208	evo-x2-cool-front.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5208	evo-x2-cool-front.exe
5208	evo-x2-cool-front.exe
5208	evo-x2-cool-front.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4920	2984	evo-x2-cool-setup-0.6.3.exe	90
PID 4920 wrote to memory of 3348	4920	evo-x2-cool-setup-0.6.3.tmp	92
PID 4920 wrote to memory of 3076	4920	evo-x2-cool-setup-0.6.3.tmp	95
PID 4920 wrote to memory of 5048	4920	evo-x2-cool-setup-0.6.3.tmp	97
PID 4920 wrote to memory of 1412	4920	evo-x2-cool-setup-0.6.3.tmp	102
PID 4920 wrote to memory of 700	4920	evo-x2-cool-setup-0.6.3.tmp	106
PID 4920 wrote to memory of 2032	4920	evo-x2-cool-setup-0.6.3.tmp	109

C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.3.exe
"C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\is-KRL9198IIP.tmp\evo-x2-cool-setup-0.6.3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KRL9198IIP.tmp\evo-x2-cool-setup-0.6.3.tmp" /SL5="$401B6,3991941,848384,C:\Users\Admin\AppData\Local\Temp\evo-x2-cool-setup-0.6.3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\system32\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /im evo-x2-cool-front.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- - C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\evo-x2-cool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\evo-x2-cool.exe" --entfernen
    3⤵
    - Executes dropped EXE
    PID:3076
- - C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\evo-x2-cool.exe
    "C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\evo-x2-cool.exe" --stopp
    3⤵
    - Executes dropped EXE
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\PawnIO_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\PawnIO_setup.exe" -install
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- - C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --installieren
    3⤵
    - Executes dropped EXE
    PID:700
- - C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
    "C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe"
    3⤵
    - Executes dropped EXE
    PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3268

C:\PROGRA~1\EVO-X2~1\evo-x2-cool-front.exe
C:\PROGRA~1\EVO-X2~1\EVO-X2~2.EXE
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5208

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f2f326e8-a329-9247-877b-29627d317f36}\pawnio.inf" "9" "4c553107b" "0000000000000188" "WinSta0\Default" "0000000000000184" "208" "c:\windows\temp\pawnio_656a9043.tmp"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5944

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf" "oem1.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000188" "2344"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe
"C:\Program Files\EVO-X2-COOL\evo-x2-cool.exe" --dienst
1⤵
- Executes dropped EXE
PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sprache-de.ini

Path C:\PROGRA~1\EVO-X2~1\sprache-de.ini
Size 10KB
SHA256 2c3a763a9071a0a45447e5e42c83a7dbce5b26f2bac51283f656c5e9b614b0ac
MD5 171a066c2d6d87dc23749c06da7bb512
SHA1 3614af0cb5ad96776d0e5e94e1a997d52c3df6b6
SHA512 1c2b0738aa6844645cf99e25e1635efbc8da1fe5c806d762aab6ebf1e44a49b9b6c97e71c3ef56c299bfde5b837609222728be529df4bda14189077dfac6e8be
SSDEEP 192:tQe4FCZHsX0jzGjz2/vg6r4mvl0UUnE9a9MKz7S+YlbJxH4GK:tQY5sXwBRvl0Ua8xM78Ba
TLSH
T1AB22EE0227E81508B6F36FA5ADB590606B6BBEE66C7DC40C11C0D24D28F1A45DA77BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evo-x2-cool-front.exe

Path C:\Program Files\EVO-X2-COOL\evo-x2-cool-front.exe
Size 77KB
SHA256 a5a28519b452b54313af71e166c24950e348532f2c68cc147f79318f32f8233b
MD5 e7c65f22917f3ea6be722cf7940548c6
SHA1 9ef9ebd9e824bdfb5f5a3542f477c89cd92efe45
SHA512 c7dfcf43cb26978a54e58d99163581e15c889033fb9981a1c37188b7612737c3b0efe270408fb75840ba2c3a63725d9b89cd6119b134eba36cc708ac0b072006
SSDEEP 1536:tbcaUMuDVcxAfZzoqvYxh8xl5BFXkRo9Y2j:9caUM8Vc2fZEkYwxjBMo6
TLSH
T10E736B1073D400E9F87B4779D9F24103EA71F88A473186CF16A0D1A96E366C19E7EB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AMDFamily17.bin

Path C:\Program Files\EVO-X2-COOL\pawnio\AMDFamily17.bin
Size 10KB
SHA256 dae74615761b78bdf064dfb3e136252ddcc6fc727d88f14738d0e5800d427a91
MD5 720ae7e9b3bdc3ca2826522a819929cf
SHA1 81031241e039064ebefa756a23a2f96c37777ed8
SHA512 13f4d95309fb864f801df94ed33f4d3b57b1452a4c9a08e16d2a05722f24440dccb31a915215b5ca2c97f9cb7d18c4a28bf9d7887ef3648be672dc5e8199d592
SSDEEP 96:W5qC1d30dVz7J8jPshTe5tOCGp6i7mIz3tFUz4qPl/nTHBDUsx0:uZdM6aYz
TLSH
T16E22C446B9C1CA76C8494B730D8AD640B7B8FD178D2DAB073489B31F5EBF99CA442718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LpcACPIEC.bin

Path C:\Program Files\EVO-X2-COOL\pawnio\LpcACPIEC.bin
Size 2KB
SHA256 c38fd116e7aff4d1fdb0a494e296be0a6708e5a22fc72f14587442fb7f8f7906
MD5 5174e23ad9df4f1f0b45c8fd31b00ea4
SHA1 7cf2a364f3ca2f71dfc943953d32bf68ba4fd66b
SHA512 dda77363472d1e0fd17982e59667db409330185103ad7b1de91b1b25b0ba8f359cc2851050fc5acfe4442009a6fc6b4b8a28e1a65e592d02086beaf7b5352c2a
TLSH
T13A514426B9C18EB4CA490A370DC9C111A7B8FE06581E6F43304DBB5C8DBF49D3A41718
MD5 SHA1 SHA512 TLSH

Submit Download

einstellungen.ini

Path C:\ProgramData\evo-x2-cool\einstellungen.ini
Size 521B
SHA256 38315bb8cbf2373fa3f8db028daa55d2f7158af9fbedfeae2e02268af9f0f2c6
MD5 b98365b5554f8fd32ca3dd6eb3f30d28
SHA1 4db817b95503268fcd1ace65c68d3dc945f8822a
SHA512 7e47d61cc5ef74d5b6460a68cbe27ec1fee46c40e252ac114580466e21e57af1a977a1b19a5044bcdf2ec52550b1855226bed2ac84b1937cc03ca4d87aa83c58
TLSH
T190F005043EBEC125E1D63C3DF81A1198A3E664005823B154D7497ECA5E0D967433FCEC
MD5 SHA1 SHA512 TLSH

Submit Download

einstellungen.ini

Path C:\ProgramData\evo-x2-cool\einstellungen.ini
Size 543B
SHA256 297c96dd1004e997dff4ec66fdc8f2c736dfa048fddead24421c0bbadb3f793e
MD5 14ba1fe351112ec984b58e03c2d439d1
SHA1 2757aa8bb5cb68e3c64dbf673de03bf592ee4996
SHA512 501254c8b7214b60e72aa72d6aeacb754f4673e08876773f3afeea4e023bc4d249303d13a3fabf99b250383be6b922cdcc4b75a340ec284a9713519bd4943b8c
TLSH
T17DF0C0043EBAC125E1D63D3DF81A11A8A3E664045822B554DB496E8B5E0D96B933FCEC
MD5 SHA1 SHA512 TLSH

Submit Download

evo-x2-cool-setup-0.6.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KRL9198IIP.tmp\evo-x2-cool-setup-0.6.3.tmp
Size 4.1MB
SHA256 c0d7579742bfb90140a2820d22cc26a55abe1724e221000b4f130609052f30a4
MD5 a89a824b81836a60339f848815bb4985
SHA1 923b6205e9f4e93a53172b936b61b3eb6fc4a20f
SHA512 08e32725492e36a4a59ba33c22422e2a1b7d728f281bee4f15c9465cd31658b0d30dfe80e511351a1bdd9f2d5d2098fa0cabeb04457a7619bae9256e88e38270
SSDEEP 98304:d9SZUvl30aj90ZFcvdQ0hdgvminQLMj+J3333d:yItJj90Z6RgKwW
TLSH
T128168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO_setup.exe

Path C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\PawnIO_setup.exe
Size 3.3MB
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

evo-x2-cool.exe

Path C:\Users\Admin\AppData\Local\Temp\is-VPPQHCI7FI.tmp\evo-x2-cool.exe
Size 61KB
SHA256 fa0a7b1de00a8edccd2f3fdce4344a9cf5771761b82ef64187558dfd33dd33f4
MD5 1e7cbb2b116ed70cec7ee34d5610f06d
SHA1 13971b23fc26c68871d1899d4a69d1a71b000a43
SHA512 3d69432698d6cd0b6766bdc98a0b6ec582898d31ce82dd77030f6be76216bd6a9b4c48fe52871e1ab2c4c150273d37369e13398e20cd2e8e539cb83a4de32a9b
SSDEEP 1536:W2HqNaBs0y9UyhIgwL58/XFGcRBFXkRo:W6U9U15LuIcRBMo
TLSH
T180539D4073E904F9D5639234E5B31A07F871F8250322AADF07B5D66C2F27AC06D7AA97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pawnio.inf_amd64_a72a2f969b8b7496.ini

Path C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini
Size 413B
SHA256 9dbed769d8e23cf1b7b114fead54b853ed310fbc8947e73c2d784dac4b9fd30a
MD5 6fb444915458f7ce5ec7d5195b7e3c99
SHA1 784740387147fc9aef3093d09ce3f7748b0d5080
SHA512 09041e101ce95c0ddedb9f5a7885d7ee6f4ea769fa25e39cef5486fdca3191a164d17ea682fb872f576744e7c7436b1f7b2a8e46c13531eae3ef9231ebb060fb
TLSH
T1D4E09253092D11DFCB01854B033EFA6A9A4FB26D8471BDDDB640DDA43A03D625E75932
MD5 SHA1 SHA512 TLSH

Submit Download

pawnio.cat

Path C:\Windows\Temp\PAWNIO~1.TMP\pawnio.cat
Size 11KB
SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
MD5 8045cc5d557423c7cef1ddc814abe8a3
SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
TLSH
T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO.inf

Path C:\Windows\Temp\PawnIO_656A9043.tmp\PawnIO.inf
Size 1KB
SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
MD5 0a33770fb7ac5bdf673e6d1bb78adc61
SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
TLSH
T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.sys

Path C:\Windows\Temp\PawnIO_656A9043.tmp\PawnIO.sys
Size 133KB
SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
MD5 a9ebaa64ddefba4f4ad3b3071c582a24
SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
TLSH
T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2984-159-0x0000000000F80000-0x000000000105E000-memory.dmp

Download

memory/2984-0-0x0000000000F80000-0x000000000105E000-memory.dmp

Download

memory/2984-8-0x0000000000F80000-0x000000000105E000-memory.dmp

Download

memory/4920-12-0x0000000000020000-0x0000000000459000-memory.dmp

Download

memory/4920-72-0x0000000000020000-0x0000000000459000-memory.dmp

Download

memory/4920-70-0x0000000000020000-0x0000000000459000-memory.dmp

Download

memory/4920-10-0x0000000002970000-0x0000000002971000-memory.dmp

Download

memory/4920-156-0x0000000000020000-0x0000000000459000-memory.dmp

Download

memory/4920-158-0x0000000000020000-0x0000000000459000-memory.dmp

Download

memory/4920-9-0x0000000000020000-0x0000000000459000-memory.dmp

Download

memory/4920-6-0x0000000002970000-0x0000000002971000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads