Extracted

• • Target
    WizWorm.exe
  • Size 14.6MB
  • SHA256 2daa630ffe26dfd66079d179d19b4c81adacec6a3bc10b9ef82e4ff2cb44fe82
  • MD5 7169bfcd284ce16dc1c223d6a75cbc12
  • SHA1 3ffeb5deb960edd28b9766d52e7a3700e3ced0ff
  • SHA512 9e53b45be18025cfb4353cb697cda6261de6609c7f841d05cf6b9926d473aff3e8b4cedb72c1b5b7ccb6944b912b5c3e69bffce612942a3d8c3a506c04a7b906
  • SSDEEP 393216:RhhABQ2q8BGIgnANvaLH6Cwh0gjoO/KYRr:RhCBHq8BGIKA5aH6COT/H
  • TLSH
    T1C0F633A17388DAB0EE7A9639F0D7D27D16FC384D21319519BCE451C79A2232C1B1BA73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistenceprivilege_escalationransomwarerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  behavioral1behavioral2