Analysis
- user interaction
yes - max time kernel
3s - max time network
23s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 19:29
General
- Target WizWorm v4.5.exe
- Size 13.5MB
- Sample261002-x7anmsxerc
- SHA256 e9894d2cf4c70de5be608fd7b54db239c46f98e6c90ff27232028cc04d78684c
Malware Config
Signatures
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WizWorm v4.5.exe"C:\Users\Admin\AppData\Local\Temp\WizWorm v4.5.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\c.exe"C:\Users\Admin\AppData\Local\Temp\c.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "c" /tr "C:\Users\Admin\AppData\Local\Temp\c.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"C:\Users\Admin\AppData\Local\Temp\WizWorm.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\c.exeC:\Users\Admin\AppData\Local\Temp\c.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WizWorm.exe
c.exe
memory/1192-13-0x0000000000770000-0x000000000078A000-memory.dmp
memory/1192-40-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1192-15-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1192-14-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-25-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-33-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-39-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-38-0x000001F8AB400000-0x000001F8AC5F2000-memory.dmp
memory/1344-24-0x000001F88FEC0000-0x000001F890D14000-memory.dmp
memory/1344-26-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-36-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-27-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-28-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-35-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-30-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-31-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-32-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/1344-34-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/5904-5-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/5904-29-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/5904-0-0x00007FF97817F000-0x00007FF978180000-memory.dmp
memory/5904-1-0x00000000009D0000-0x0000000001756000-memory.dmp
memory/5904-3-0x00007FF977FF0000-0x00007FF978994000-memory.dmp
memory/5904-2-0x00007FF977FF0000-0x00007FF978994000-memory.dmp