Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 11:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
fwidget.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
fwidget.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target fwidget.exe
- Size 3.4MB
- Sample260810-nvkteagm5s
- SHA256 e4e97e009fa01fe2e2e5a4de13b1e31a9fe6336edc6dfbd0f2cc44cdef874c6b
- MD5 8b5b0048f7b8c5ec47b226f96272869e
- SHA1 b04889419f02ec2ff7ea3220d1000ae66d95de76
- SHA512 6d87751e0795b445ef2c8b3e04468fe402b048b21cb838010dafa57368af48b59d8a0bc4b6472a9b81e2e7a157d26e99c461454c3d4b9df51f0404b5bb2ab3cd
- SSDEEP 49152:sHPYDbmraOTT64RqJ1L4J92NxZ+cpIsyYV2UJ9dqC1BAUZLYgiU7IZGaXBuQQ9ez:zcH64RqfLaMxnv/9IC1BAUZLGN
- TLSH T156F59D43F29361ECC627C13086676773FA32FC2426216E7B6554FB342E72EA01B58B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3784-2-0x00007FF77D2B0000-0x00007FF77D61F000-memory.dmp disable_win_def behavioral2/memory/3784-3-0x00007FF77D2B0000-0x00007FF77D61F000-memory.dmp disable_win_def - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe 3784 fwidget.exe