Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 08:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fwidget.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fwidget.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target fwidget.exe
- Size 3.4MB
- Sample260810-klqrhsfa63
- SHA256 6ac26bde357b48fe13dd1d281b3d6b892c0772f64958967d79a4e85d436912bd
- MD5 8a95717b0dd52867c19908c655b8d827
- SHA1 6a914d1d8b980f2d7d50a3a90ccdcf11362f245e
- SHA512 287a7d8e6bca284440bd03b4deb0c283062917c007cfaed5fb5f4bffa67e36276c0a333e12893be4797d95b05a9567ffbbceb0ce41800ab60bf419134d08e610
- SSDEEP 49152:r4ONwCk8qI+Blf68rFXPy9rKhsR00BwG023vrvg3baD+ZZlV1BAUZLYgiU7IZGah:l2bf68rFPw6f9Ba6ZTV1BAUZLGN
- TLSH T1E0F59E43F2A361ECC627C13486676733FA32FC2416216E7B6554FB352E72EA01B58B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService fwidget.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmemctl fwidget.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci fwidget.exe - Looks for Xen service registry key. 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xenevtchn fwidget.exe - Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 3 discord.com 7 discord.com 11 discord.com 1 discord.com - Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 1 ip-api.com 3 api.ipify.org 3 ip-api.com 14 api.ipify.org - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3224 cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fwidget.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 6072 WMIC.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemFamily fwidget.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS fwidget.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName fwidget.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5776 fwidget.exe 5776 fwidget.exe 5776 fwidget.exe 5776 fwidget.exe 5776 fwidget.exe 5776 fwidget.exe 6072 WMIC.exe 6072 WMIC.exe 6072 WMIC.exe 6072 WMIC.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 6072 WMIC.exe Token: SeSecurityPrivilege 6072 WMIC.exe Token: SeTakeOwnershipPrivilege 6072 WMIC.exe Token: SeLoadDriverPrivilege 6072 WMIC.exe Token: SeSystemProfilePrivilege 6072 WMIC.exe Token: SeSystemtimePrivilege 6072 WMIC.exe Token: SeProfSingleProcessPrivilege 6072 WMIC.exe Token: SeIncBasePriorityPrivilege 6072 WMIC.exe Token: SeCreatePagefilePrivilege 6072 WMIC.exe Token: SeBackupPrivilege 6072 WMIC.exe Token: SeRestorePrivilege 6072 WMIC.exe Token: SeShutdownPrivilege 6072 WMIC.exe Token: SeDebugPrivilege 6072 WMIC.exe Token: SeSystemEnvironmentPrivilege 6072 WMIC.exe Token: SeRemoteShutdownPrivilege 6072 WMIC.exe Token: SeUndockPrivilege 6072 WMIC.exe Token: SeManageVolumePrivilege 6072 WMIC.exe Token: 33 6072 WMIC.exe Token: 34 6072 WMIC.exe Token: 35 6072 WMIC.exe Token: 36 6072 WMIC.exe Token: SeIncreaseQuotaPrivilege 6072 WMIC.exe Token: SeSecurityPrivilege 6072 WMIC.exe Token: SeTakeOwnershipPrivilege 6072 WMIC.exe Token: SeLoadDriverPrivilege 6072 WMIC.exe Token: SeSystemProfilePrivilege 6072 WMIC.exe Token: SeSystemtimePrivilege 6072 WMIC.exe Token: SeProfSingleProcessPrivilege 6072 WMIC.exe Token: SeIncBasePriorityPrivilege 6072 WMIC.exe Token: SeCreatePagefilePrivilege 6072 WMIC.exe Token: SeBackupPrivilege 6072 WMIC.exe Token: SeRestorePrivilege 6072 WMIC.exe Token: SeShutdownPrivilege 6072 WMIC.exe Token: SeDebugPrivilege 6072 WMIC.exe Token: SeSystemEnvironmentPrivilege 6072 WMIC.exe Token: SeRemoteShutdownPrivilege 6072 WMIC.exe Token: SeUndockPrivilege 6072 WMIC.exe Token: SeManageVolumePrivilege 6072 WMIC.exe Token: 33 6072 WMIC.exe Token: 34 6072 WMIC.exe Token: 35 6072 WMIC.exe Token: 36 6072 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5776 wrote to memory of 3224 5776 fwidget.exe 90 PID 3224 wrote to memory of 6072 3224 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\fwidget.exe"C:\Users\Admin\AppData\Local\Temp\fwidget.exe"1⤵
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Looks for Xen service registry key.
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name /value 2>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6072
-
-