General
- Target WizWorm v4.5.exe
- Size 13.5MB
- Sample260820-nx186sbm51
- SHA256 e9894d2cf4c70de5be608fd7b54db239c46f98e6c90ff27232028cc04d78684c
- MD5 2520d9ef63e705b26e8e3086abc62554
- SHA1 0c8381468f1cce2645be21dc1bc104c62cd37cce
- SHA512 e77b89cd8191d9456a3679cfbdab3384694c17cd46383b060b1f6dfa58ae56ef688c7619ea11be0d0b65813d1bc8661b982d3205ae526f2efbb946d615590c44
- SSDEEP 393216:iX4Gz3FWxxuHpyLQ8qmoJh1AMs6Tl5gUt:ioGQxxOpn8W8GLL
- TLSH T1C8E63301AA134935C77F2233D3640AD087E729C95E352F2D6BA81F92F5A51D426C2EFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WizWorm v4.5.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
WizWorm v4.5.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target WizWorm v4.5.exe
- Size 13.5MB
- SHA256 e9894d2cf4c70de5be608fd7b54db239c46f98e6c90ff27232028cc04d78684c
- MD5 2520d9ef63e705b26e8e3086abc62554
- SHA1 0c8381468f1cce2645be21dc1bc104c62cd37cce
- SHA512 e77b89cd8191d9456a3679cfbdab3384694c17cd46383b060b1f6dfa58ae56ef688c7619ea11be0d0b65813d1bc8661b982d3205ae526f2efbb946d615590c44
- SSDEEP 393216:iX4Gz3FWxxuHpyLQ8qmoJh1AMs6Tl5gUt:ioGQxxOpn8W8GLL
- TLSH T1C8E63301AA134935C77F2233D3640AD087E729C95E352F2D6BA81F92F5A51D426C2EFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1