Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 07:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fwidget.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fwidget.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target fwidget.exe
- Size 3.4MB
- Sample260810-jaepfadl2s
- SHA256 ea760e6f253b5795a276316ef66f478526d73758dd2aedcc7c924944b4fadac9
- MD5 a7be7c24a1185231f24e1c76ccad5ef8
- SHA1 c5a56be06856e795a3c8c8309db437580bdd81b8
- SHA512 02ed960fb3b2bd00b9c5888c520ebbfad6fc3eacfcbf9e57d5565304b6f81edeb1f91440f0cafda9990cd940eb3b25d50a4a7dda0411ab5fa9643b85cd17c511
- SSDEEP 49152:oAibHiZsiWNp0U05QKlaSu8JBsDb2xbcyomJgy5F0fRJx21BAUZLYgiU7IZGaXBL:3MWU05QdShm7B5fR/21BAUZLGN
- TLSH T1D9F59D43F2A361ECC627C1308657A773FA32FC2416216E7B6554FB342E72EA01B59B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService fwidget.exe - Looks for VMWare services registry key. 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmemctl fwidget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci fwidget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmware fwidget.exe - Looks for Xen service registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn fwidget.exe - Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 2 discord.com 3 discord.com - Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 2 api.ipify.org 2 ip-api.com 6 api.ipify.org - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2924 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fwidget.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 800 WMIC.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fwidget.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2508 fwidget.exe 2508 fwidget.exe 2508 fwidget.exe 2508 fwidget.exe 800 WMIC.exe 800 WMIC.exe 800 WMIC.exe 800 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 800 WMIC.exe Token: SeSecurityPrivilege 800 WMIC.exe Token: SeTakeOwnershipPrivilege 800 WMIC.exe Token: SeLoadDriverPrivilege 800 WMIC.exe Token: SeSystemProfilePrivilege 800 WMIC.exe Token: SeSystemtimePrivilege 800 WMIC.exe Token: SeProfSingleProcessPrivilege 800 WMIC.exe Token: SeIncBasePriorityPrivilege 800 WMIC.exe Token: SeCreatePagefilePrivilege 800 WMIC.exe Token: SeBackupPrivilege 800 WMIC.exe Token: SeRestorePrivilege 800 WMIC.exe Token: SeShutdownPrivilege 800 WMIC.exe Token: SeDebugPrivilege 800 WMIC.exe Token: SeSystemEnvironmentPrivilege 800 WMIC.exe Token: SeRemoteShutdownPrivilege 800 WMIC.exe Token: SeUndockPrivilege 800 WMIC.exe Token: SeManageVolumePrivilege 800 WMIC.exe Token: 33 800 WMIC.exe Token: 34 800 WMIC.exe Token: 35 800 WMIC.exe Token: 36 800 WMIC.exe Token: SeIncreaseQuotaPrivilege 800 WMIC.exe Token: SeSecurityPrivilege 800 WMIC.exe Token: SeTakeOwnershipPrivilege 800 WMIC.exe Token: SeLoadDriverPrivilege 800 WMIC.exe Token: SeSystemProfilePrivilege 800 WMIC.exe Token: SeSystemtimePrivilege 800 WMIC.exe Token: SeProfSingleProcessPrivilege 800 WMIC.exe Token: SeIncBasePriorityPrivilege 800 WMIC.exe Token: SeCreatePagefilePrivilege 800 WMIC.exe Token: SeBackupPrivilege 800 WMIC.exe Token: SeRestorePrivilege 800 WMIC.exe Token: SeShutdownPrivilege 800 WMIC.exe Token: SeDebugPrivilege 800 WMIC.exe Token: SeSystemEnvironmentPrivilege 800 WMIC.exe Token: SeRemoteShutdownPrivilege 800 WMIC.exe Token: SeUndockPrivilege 800 WMIC.exe Token: SeManageVolumePrivilege 800 WMIC.exe Token: 33 800 WMIC.exe Token: 34 800 WMIC.exe Token: 35 800 WMIC.exe Token: 36 800 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2924 2508 fwidget.exe 89 PID 2924 wrote to memory of 800 2924 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\fwidget.exe"C:\Users\Admin\AppData\Local\Temp\fwidget.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name /value 2>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-