6c5b6a60eccf05cdde6e54685edb0328133de92bf203a282d5463f173711e069

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file_ad6ea8ff7c86f0ad.exe
Size 1.9MB
Sample260930-ppqm5sfc96
SHA256 6c5b6a60eccf05cdde6e54685edb0328133de92bf203a282d5463f173711e069
MD5 6033877fd5070d99bf6f1a022ee819fc
SHA1 bfb66508c6fcc1c17db4fd774309f43e38fb941d
SHA512 3541ae9011c45fb9d4419de5a4eb9f0313d9484eef0b9a5dd58b3e72d9ac5cfcf5f225347ae12b448d004e5730b36bc6ecc5eb49da02fd2adfdd4b05658b1093
SSDEEP 49152:Mt2GItq26SxLBvEo7vrOWWi/fU8ERr4QJ+tT:ThvxWiEBrnJmT
TLSH
T1A295128FEB6616F6D47DD1B884129242FFA47C124B609FDB6A606C720D63EEC5E39700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4020	Widgets.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Widgets.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Widgets.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4020	1072	file_ad6ea8ff7c86f0ad.exe	85

C:\Users\Admin\AppData\Local\Temp\file_ad6ea8ff7c86f0ad.exe
"C:\Users\Admin\AppData\Local\Temp\file_ad6ea8ff7c86f0ad.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Widgets.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\\Widgets.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Widgets.exe

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Widgets.exe
Size 1.5MB
SHA256 98d3b0eabdd6dba168a14f0cd4c4ebe4543a975e6215e342aba8d7abff007df7
MD5 7735566d8f3bc5aa2a5af2ff9a783f35
SHA1 d3b13bb9d31195bc96fe1e748743beba656ec4bb
SHA512 34c965d96ace76ebb1b9949b60fed01ac48a8463b77ed9e39d909ab4343d1ad9a8cb475ecd580a94aa3d80574bcf942ae55c89fd588653cde8941298de5548ee
SSDEEP 24576:aLT0n6fW8IVk38D6mslcTnLafESJDJjd+exUgzwLl9N:Wm6u8IVg8D6ms6hMJjd8
TLSH
T1D565B01F679412DAD13B93BD94D58B81F9A1B8050B309EDB016619E92E27EFC0F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download