General
-
Target
WizClient2.exe
-
Size
75KB
-
Sample
241031-dvz8zsxkf1
-
MD5
f19b33379b749f757bb47c0866af8808
-
SHA1
a6c2232d04376cbe0ce75ac09bd7d86477b4a5da
-
SHA256
2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103
-
SHA512
c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11
-
SSDEEP
1536:pfJ0uhhgY+OGijd//2TJ17MZab2p7gSb3NzuNU5/nU6i6JbKcOOLepntw:pfJ0mYOGijd/eV1mab2Bjb3NzaU5FZOq
Behavioral task
behavioral1
Sample
WizClient2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
WizClient2.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
xworm
fe80::edf5:92cd:756d:3fbd%9:5552
-
Install_directory
%AppData%
-
install_file
USB.exe
Targets
-
-
Target
WizClient2.exe
-
Size
75KB
-
MD5
f19b33379b749f757bb47c0866af8808
-
SHA1
a6c2232d04376cbe0ce75ac09bd7d86477b4a5da
-
SHA256
2aebedd83903b137349f36ffb767c5ddfaa5aa0168b980203895546fe71f2103
-
SHA512
c19b8b2ea1f93e4d0639aabad12bed369ae6cf198f5b0d8d471c64a1cbcec4a1837ce93c5cbc86ee6a68bca440cb2c0fa8fe5e7e963c18165ffa3ab01e173a11
-
SSDEEP
1536:pfJ0uhhgY+OGijd//2TJ17MZab2p7gSb3NzuNU5/nU6i6JbKcOOLepntw:pfJ0mYOGijd/eV1mab2Bjb3NzaU5FZOq
Score10/10-
Detect Xworm Payload
-
Xworm family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1