General
-
Target
WizClient.exe
-
Size
71KB
-
Sample
240629-3v8ykazcjd
-
MD5
d44c860012d295bcfa6e9bf3b0c3aca3
-
SHA1
9a622d006add8c5dc22a5af3f3be4915bc3cc151
-
SHA256
49207b8675c5ea9e826cd0d5e9fd119881085a4693edc6c39bb11cbe5b888b34
-
SHA512
e708c4965f316629c172728e9e7b4a2f1313c0fc1dd9d0254a2da1c3a3225c2684c2259387fa5c5ed3e874db7fbc474fe8830efaa45a14c9137cd5c647cc2091
-
SSDEEP
1536:8KjrBup8SrL+RjWj9QlDoapk/yDeYyLjZbibi3vy6XhSQOMqAvBu:8KjO8U+RjWj9QlG/y6VLjZbicv9SQOMk
Behavioral task
behavioral1
Sample
WizClient.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
xworm
happy-wrist.gl.at.ply.gg:45652
wiz.bounceme.net:6000
-
Install_directory
%Temp%
-
install_file
USB.exe
Targets
-
-
Target
WizClient.exe
-
Size
71KB
-
MD5
d44c860012d295bcfa6e9bf3b0c3aca3
-
SHA1
9a622d006add8c5dc22a5af3f3be4915bc3cc151
-
SHA256
49207b8675c5ea9e826cd0d5e9fd119881085a4693edc6c39bb11cbe5b888b34
-
SHA512
e708c4965f316629c172728e9e7b4a2f1313c0fc1dd9d0254a2da1c3a3225c2684c2259387fa5c5ed3e874db7fbc474fe8830efaa45a14c9137cd5c647cc2091
-
SSDEEP
1536:8KjrBup8SrL+RjWj9QlDoapk/yDeYyLjZbibi3vy6XhSQOMqAvBu:8KjO8U+RjWj9QlG/y6VLjZbicv9SQOMk
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1