4c709febc184ffe54a70a0c028b55236fc4ce083872b6be25419dc7d58e20911

Sharing

Copy URL Twitter E-mail

General

Target
WizWorm v4.7z
Size 34.1MB
Sample260629-thdr8aht5x
SHA256 4c709febc184ffe54a70a0c028b55236fc4ce083872b6be25419dc7d58e20911
MD5 e10f9051177e0441bc8acfdd0e7845ce
SHA1 4263711ba87d617b12f77ccd57b2b2f083bfb586
SHA512 df44cca1bec150dd8339595c80285b22955d1771d213bff0315c7e259f71d5a1cea548a7037e6bc53edda6eddbfb584d78bc9a45daf52319d3777ab4efc0bb68
SSDEEP 786432:CjmCP0C1PLdV6GxPL3MVwVXspziO09aZ4iEmtwCYPiwucdGJr:Ca80CVjVxbMViSmG4Fmtx+dGV
TLSH
T1A0773329B821AE791519A973AB0D1F3877DDDB4FE0500424037CEC55FB396FEA421A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WizWorm v4.7z
- Size 34.1MB
- SHA256 4c709febc184ffe54a70a0c028b55236fc4ce083872b6be25419dc7d58e20911
- MD5 e10f9051177e0441bc8acfdd0e7845ce
- SHA1 4263711ba87d617b12f77ccd57b2b2f083bfb586
- SHA512 df44cca1bec150dd8339595c80285b22955d1771d213bff0315c7e259f71d5a1cea548a7037e6bc53edda6eddbfb584d78bc9a45daf52319d3777ab4efc0bb68
- SSDEEP 786432:CjmCP0C1PLdV6GxPL3MVwVXspziO09aZ4iEmtwCYPiwucdGJr:Ca80CVjVxbMViSmG4Fmtx+dGV
- TLSH
  T1A0773329B821AE791519A973AB0D1F3877DDDB4FE0500424037CEC55FB396FEA421A8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  WizWorm v4/Background.png
- Size 17KB
- SHA256 5047dc90d705a1a50c325fc00b26d5290939c42d6aa727d09e8d21d0537cec85
- MD5 a466fc11f42a6de40e050c9813947612
- SHA1 81845f1a0a98f590d97670c19d0a762123a2a539
- SHA512 59e3349a9291abe96c663e2f63345ea13c79e9a8a716a9408e74526f05642f1a8d59cc5ae866287299a4aa4a4fb8385f509de0d2dab483ffa6859a6a29c24556
- SSDEEP 192:lCxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxp:s2wDZijJE+w2QIfGR
- TLSH
  T181827D29324091A1C0E4997F282D67A5BB87BE274744DF46B2F702FD8C13BD4D9843C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  WizWorm v4/Fixer.bat
- Size 126B
- SHA256 b13589d839dded18a4b7258c6418dbee5759665f4eb18878ce2a76bca31b7753
- MD5 3e41f6c12444d0c72b8c2d9be75f2efd
- SHA1 64e6cd77417d3e355c36ee1d15677723c96b6695
- SHA512 b8b0975a58a2aa161b691f44d6e0e0dd99f76381e2f94f49cda1eec4b5ca6a68200b9534d0f73cdc332b9f243d051c41038231852c969b77f418b5711c9e4f99
- TLSH
  T13FB02B17A492E2A097D00C4302B822CE39FC9012C291D3C37522C430CD814F0C733E95
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  WizWorm v4/GeoIP.dat
- Size 1.2MB
- SHA256 bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
- MD5 8ef41798df108ce9bd41382c9721b1c9
- SHA1 1e6227635a12039f4d380531b032bf773f0e6de0
- SHA512 4c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
- SSDEEP 24576:0L/59ah0USm3uwl00odi9AnW1fUmdbxv6bA3wOzRAc3InsZLONMrZb:+/59a6USdi9Ues6bV6boLO6rZ
- TLSH
  T10C457B47FF0A85DB5845B91EF9019EDC5810EE76BD0A1335226E37ACA0B8360ECD71A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  WizWorm v4/Intro.wav
- Size 591KB
- SHA256 7ef5b1508c6187f45cb9803436238658f82ecbfe43ae3fffe5b0d22a86f79600
- MD5 d0b4077dc5623a51a8dd9fa37cafbf62
- SHA1 9793779439a4e0bf5be28d1ff5e688dfb087c263
- SHA512 a94020fc4782a13b72f7729888f5ebc6e4d806a2b705bdeeae5305815d5fe177db57dd17b40c5cbeae0d8491f4f6a5e63e23485014ed8384358877b87b4cda71
- SSDEEP 12288:xQTnCQZpwxE4HWPNgu65sFNjAXRnkj/4oj59DP67rpO8+COHhrG:xiFXeWeLsH4oN99rG
- TLSH
  T138D4E782F241EA50C4555E7B5D2AA9D453327ADAEF4B63223050BB3E3CF74839E297C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  WizWorm v4/Plugins/Recovery.pdb
- Size 389KB
- SHA256 369abdb551aaa3316966e76156d033f772b9241927fa91219f562198bed1fc1a
- MD5 e2f30b206116d4e16085725be92fb679
- SHA1 bf0c0053645c17044a79f8d82a70fd97959fd26f
- SHA512 6c257f5a0c51c72f9fb24357b00f8ab4fa69354bcd768ec944f32d617e9028a23ef7cc59114c43fb91d2f3454948fced5aed6c8d44cca45a9c6a2d08aedf3098
- SSDEEP 6144:OCv9V09T95F+HXfkSx4RQd69M9xBzEYryb6D:Xld/9zEYrC
- TLSH
  T1F1847307BF81C932C4A6C63852AF8F1D4338E584DB87A74F6B95B16C3ED23561E472A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  WizWorm v4/Plugins/ReverseProxy.xml
- Size 665B
- SHA256 9be09e749f9e2412085e547d16a4ff6a9636e31e700dd7e782eaf9db8b69bf6b
- MD5 5163e1bb1064641395e458a715af0a26
- SHA1 101e14d6bef372390bbc04f9877c484090504734
- SHA512 47eaa0aba56cc2cd8558e66a6a9e8ac51decf9a46c1cf27a524f0174cd4d980201be864c991320b6921ba236b3d4041953234f8459ba8b0eb5a8bcf94fc18acd
- TLSH
  T15D01D602A389AD354D35153B2D94B8C8318B5A25D978240DDC7929370BE13DA63EBDA1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral25 behavioral26 behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28