14d205bb959f90f2f303a133dcd700707aca95b5fb0a20d0470f7294eaba0eb5

Analysis

user interaction
yes
max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cw2.exe
Size 56KB
Sample260801-ey86qsdf22
SHA256 14d205bb959f90f2f303a133dcd700707aca95b5fb0a20d0470f7294eaba0eb5
MD5 c451c5c09129e3a1d95d514c50b4db70
SHA1 fed19c3d23d71a9c2ba88f215cf51a3c702faf85
SHA512 6fd28a091f6007f304a70d424d23dd6eea479fbde80b4369e948b10613b5d566223c944ebebb258f6dd849ab46f2fd93fb1e9ce27eb2ce8e70806d966685b13a
SSDEEP 768:doeqRBuzVVtIRxr5xVkptMC8/6VDN5A8WM2ynf894d5dfZDWX7GJTWtCR:d5sSvwx3VkpxyFac4d5SSc
TLSH
T19D436C5363E211E4C877E178D9662223E672F56607359BCF0370C8292F6A2E1F53EE05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4172	powershell.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	cw2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	cw2.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	cw2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	cw2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2652	cw2.exe
2652	cw2.exe
2652	cw2.exe
2652	cw2.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cw2.exe
"C:\Users\Admin\AppData\Local\Temp\cw2.exe"
1⤵
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$k=[System.Convert]::FromBase64String('MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC9fetOJxm5KDBryKBnDwGllSNerGEIZWYon8ilf5l4bPTyvTNACCZt1Ed3uhKgcyQelnGqlO0Uq4GyhpjXW9GIJdNbDmJ4Z/Cvk+pWfj/t9YdtIpQ0w9lfGpzpnTNXMQ7/E1OIlDFFCKyqSsxHCUPESor/RMpX1fL4teCK2QrNwrI2Ii0i+4xIr+wJjriTT/0RFRwvJzHuVGMHHsITjP+af90m1x0EsP65rlBlK9y2JOgIxryiP/Ek2VMFXGy6aPa/66PXbQf1Qh5iWOW+FKs6+k9ItDUYdtzfKmMU5N26rsc3rRYhEVeKZ8HynrF2hyYawjc8zhfEWTS+IlEI/k03AgMBAAECggEAVV6E461G7/10ryJwbW270rL5f94OSx+Pok62MSVm6XPA+RkXHUpusb1Yw05PtPyasbMam3zDwLOx11G/SwrhP8K20UeOQmulahysDvKK77RVomvZNFpltGyDc9YwOqBt/qng0N/ewJizXXccSAabArSIoY+Gz4Kil70s37D/ponBQvuYhxdI7YQ9bR1qQKw2UFEQw8UsrcFHHZ/JzLb/8OdT6kP081NeFaHiGeueWDMMSv1TQfSWsIAfw8s7IOSgm6klBtdzheeGqj/x+g4pYaCJXbdIkkKS7OOsWJb0ucB5KrXghnMvF5Ah14rmfCEu5u0S+oV8HrG3dY+qAAA9yQKBgQDpP7blT0DGX8lNYmL/1pATzRmB7kMG2VKZe8xw96hDI2w+gjywacbyvCftMRywDgjpUfnyG5SyUWEJo/4c49zq4CLLVGr9syoQkuDnthaYHFljWirB3EuWS4JxMuObuNVdINOtSmNNtaRol8yNQ+ERlEBfEZYVBz+mziKbdUScXwKBgQDP+ZSn7c/eQPuTpsTcUxHmN7cUQLWwz8p+Eq1XEMeaIGd+vTp86W5oHTUGr9HWVKlNUxapUNKCJawA8qwrRgwOpW4acku7SNFGuswfz7YUeVyIiAQWTfbEBX+bl47Au6ffPjnPY90XukyCD6VRtF3ANnqdMzsKMHvJBAN54AX+KQKBgG92SRpvsw6ZO4NFXvXPPO6ZdnUGvPUK6VP7OwlI8BmVVebRKdtL0QyyKYpJi+H98vg8emreD0LfbLXErmxz32BGV5o+7xnpglKFPgC8nTN3aKf3sLMPaPebgexCW05RF3T3ePA4uheqk7R/xfpD08wowlIr/0JxQlOd8h/D/FOVAoGBAK2OZwr4v2aHLiramiAPRrmrNyI0misyTJaHOZaVzyyE7Dls6rlBCDzkWtL4uJE3V43Kz/d+Fh48F902poz6SKeUUFzLkv142ARBcIT/jsBpQtpBP7/pUgvlVsdeY+fc8kuvnwi+GsxpUN2c9uZHMZFtJUe4cAWhzjtDGS+Ezxt5AoGAHG4EC7ByKxu9eFqAzWFXNKEgxEIcYNvdTxPEEIfDkxt+R+ChVBFq+QhRS13zpWX0orvmig7YRSbTda9MfLgmuMkWPc5ktQr7IpXqY7Qs3HcIy/RmKPkxn0BRoY9ndR1YaGdelhEmH/cA1W9PZjYrHH6vR42lg7REmzL7NDpc6/o=');$d=[System.Convert]::FromBase64String('ZXlKaGJHY2lPaUpTVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnBjM01pT2lKemIyWjBkMkZ5WTJGQWMyOW1kSGRoY21sallTMDFNREUwTURjdWFXRnRMbWR6WlhKMmFXTmxZV05qYjNWdWRDNWpiMjBpTENKelkyOXdaU0k2SW1oMGRIQnpPaTh2ZDNkM0xtZHZiMmRzWldGd2FYTXVZMjl0TDJGMWRHZ3ZjM0J5WldGa2MyaGxaWFJ6SWl3aVlYVmtJam9pYUhSMGNITTZMeTl2WVhWMGFESXVaMjl2WjJ4bFlYQnBjeTVqYjIwdmRHOXJaVzRpTENKbGVIQWlPakUzT0RVMU5qRTNORFlzSW1saGRDSTZNVGM0TlRVMU9ERTBObjA=');$c=[System.Security.Cryptography.CngKey]::Import($k,[System.Security.Cryptography.CngKeyBlobFormat]::Pkcs8PrivateBlob);$r=New-Object System.Security.Cryptography.RSACng $c;try{[System.Console]::Write([System.Convert]::ToBase64String($r.SignData($d,[System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1)))}catch{}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4172

C:\Users\Admin\AppData\Local\Temp\cw2.exe
C:\Users\Admin\AppData\Local\Temp\cw2.exe
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-1-0x00007FF7124B0000-0x00007FF7124C4000-memory.dmp

Download

memory/2652-0-0x00007FF7124B0000-0x00007FF7124C4000-memory.dmp

Download