d76bc68115e015a9eabbdb8678a8da0ddcb9659a5972eb13ee13785448d4b4f6

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WizardPackage_755864.exe
Size 125.9MB
Sample261020-vbexdaf17p
SHA256 d76bc68115e015a9eabbdb8678a8da0ddcb9659a5972eb13ee13785448d4b4f6
MD5 f49888ff68c3bf3a8c148d0dc4e12d1a
SHA1 5c33e2b43ec98e75fc786b4e06142b4ef0b91821
SHA512 9397dd12d282398cbd28aec0c1373dc80e5f1ad74b489580f73da67140a2790c094f591c063fc46c6d7412fd44af16558efd5b024e749d1abe881dd412854838
SSDEEP 393216:rM6EI/RK9IYUuZx556oKz4qJdCzibm1fwY5Rbmeq:rdZ/UIYx556oKizib2ftXi
TLSH
T19158E3B13DC121E0E6AECF17D6FEDB29D36667762A113C0A047767940F22782F64681B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WizardPackage_755864.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WizardPackage_755864.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WizardPackage_755864.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe
1688	WizardPackage_755864.exe

C:\Users\Admin\AppData\Local\Temp\WizardPackage_755864.exe
"C:\Users\Admin\AppData\Local\Temp\WizardPackage_755864.exe"
1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INetC.dll

Path C:\Users\Admin\AppData\Local\Temp\nskAB4F.tmp\INetC.dll
Size 140KB
SHA256 276cb301f9d140553d21016970a8d46f48f2d3532b767433c9ac369ecb86a314
MD5 21f61047b89f3be40f2a89625c55b93f
SHA1 82882c3fb5937a8f6f7e2b7e01428617d3659b2c
SHA512 e87f900f82e8fafeddf49c7f34f0042abd3058ec96a2feb21f40576a51df34b98318b5bfba3e46bb4f0bc2a2b258edebd5ab1b56fa94d6304dc6d46d6685b413
SSDEEP 3072:Pj6KCd8JRVpzIKKjLhHzte/ET0n1/r/R3d1rDCMmhmpdC:Pj48JRVp8tpz78l3dhCg
TLSH
T123E3F150EBE8C4F7FA694A34B5B22E73057E7E682D208543D233459E9927381F82D772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nskAB4F.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nskAB4F.tmp\UserInfo.dll
Size 4KB
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nskAB4F.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nskAB4F.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nskAB4F.tmp\nsProcess.dll
Size 133KB
SHA256 0284e9af04b5422029bc67c5193ff88e8e1b2232aae558ef9db746a6be664b63
MD5 8dcd3fbdeaf798b69109e9943f1a4e57
SHA1 01ca56f1c159038ebd4e2743a6fe89dd0cbf1638
SHA512 ad815b611f51df51b5ce9b63af7562a0103345968d38e327de9fa690cf7e21f8111b498d9ca8b953b3e3b398d065e19336bd8ea497516784b67a8a0d94a081e8
SSDEEP 3072:yTiO8oOREL1DIK5sylbhZalWnI/NLLAqw8gKT5vM:yTiO8teRbhZIGkdRa
TLSH
T1CBD37D0275E5C171D9BE153828709B645F7F7860CF60ADEB636409BB8E702C09F31BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zippex-guid.cache

Path C:\Users\Admin\AppData\Local\Temp\zippex-guid.cache
Size 32B
SHA256 9f410cc0d0f156cf5fe6efc84bb01ff7ffede8c6630d0c24b5ea1dc109d60e0c
MD5 4449da4bc51039ffcdfe16f2c6de1400
SHA1 3d23750345fd02c6420721a6f77378c221758326
SHA512 066fb438434653ee67cef360b2f2ed1fd05f9d71912e2c23ba286ba075f8a5e4ffe43928c65cf5fc1841f9b1f94d416a23a470d687f50ddc1d0f21af816199b5
MD5 SHA1 SHA512

Submit Download