xwizard.exe

  • File Path: C:\windows\SysWOW64\xwizard.exe
  • Description: Extensible Wizards Host Process

Hashes

Type Hash
MD5 7E421CBAF3DB19860413EC55C5B03F61
SHA1 E0C56BFD536E6C0C535A353612478A3B2A7F16A6
SHA256 90C0D77A160C70512CF2247F8B623BFAEF562B0DDB367CBA55436A01749128C7
SHA384 8D4101A94B420E7E770069E81B1A488F0BF401CCA6941E079882BDD13F40A6AAD95EE11C7E450275918AE15B7EAD1E19
SHA512 841B282D2AA0DA2D51BF73996028AEEBE52E2E29D2492DF83219893C2C521248F86708BE512AB035E017823A3324BA4431C77B1C1E3078DE0791C305E34D907B
SSDEEP 1536:wkuzn1MThM/3MV5URDoq4OZZZLlCIibl1:Q1Ma8V2RD68wbn

Signature

  • Status: The file C:\windows\SysWOW64\xwizard.exe is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170
  • Serial: ``
  • Thumbprint: ``
  • Issuer:
  • Subject:

File Metadata

  • Original Filename: xwizard.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
  • Product Version: 6.3.9600.16384
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ComputerDefaults.exe 54
C:\WINDOWS\system32\ComputerDefaults.exe 50
C:\WINDOWS\system32\ComputerDefaults.exe 50
C:\Windows\system32\ComputerDefaults.exe 52
C:\windows\system32\ComputerDefaults.exe 61
C:\Windows\system32\ComputerDefaults.exe 47
C:\Windows\system32\xwizard.exe 52
C:\windows\system32\xwizard.exe 58
C:\Windows\system32\xwizard.exe 49
C:\WINDOWS\system32\xwizard.exe 52
C:\WINDOWS\system32\xwizard.exe 49
C:\Windows\system32\xwizard.exe 50
C:\windows\SysWOW64\ComputerDefaults.exe 66
C:\WINDOWS\SysWOW64\ComputerDefaults.exe 50
C:\Windows\SysWOW64\ComputerDefaults.exe 68
C:\WINDOWS\SysWOW64\ComputerDefaults.exe 41
C:\Windows\SysWOW64\ComputerDefaults.exe 54
C:\Windows\SysWOW64\ComputerDefaults.exe 47
C:\WINDOWS\SysWOW64\xwizard.exe 54
C:\Windows\SysWOW64\xwizard.exe 58
C:\Windows\SysWOW64\xwizard.exe 54
C:\Windows\SysWOW64\xwizard.exe 57
C:\WINDOWS\SysWOW64\xwizard.exe 54

Possible Misuse

The following table contains possible examples of xwizard.exe being misused. While xwizard.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_class_exec_xwizard.yml title: Custom Class Execution via Xwizard DRL 1.0
sigma proc_creation_win_class_exec_xwizard.yml description: Detects the execution of Xwizard tool with specific arguments which utilized to run custom class properties. DRL 1.0
sigma proc_creation_win_class_exec_xwizard.yml - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ DRL 1.0
sigma proc_creation_win_class_exec_xwizard.yml Image\|endswith: '\xwizard.exe' DRL 1.0
sigma proc_creation_win_dll_sideload_xwizard.yml title: Xwizard DLL Sideloading DRL 1.0
sigma proc_creation_win_dll_sideload_xwizard.yml description: Detects the execution of Xwizard tool from the non-default directory which can be used to sideload a custom xwizards.dll DRL 1.0
sigma proc_creation_win_dll_sideload_xwizard.yml - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ DRL 1.0
sigma proc_creation_win_dll_sideload_xwizard.yml Image\|endswith: '\xwizard.exe' DRL 1.0
LOLBAS Xwizard.yml Name: Xwizard.exe  
LOLBAS Xwizard.yml - Command: xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}  
LOLBAS Xwizard.yml Description: Xwizard.exe running a custom class that has been added to the registry.  
LOLBAS Xwizard.yml - Command: xwizard RunWizard /taero /u {00000001-0000-0000-0000-0000FEEDACDC}  
LOLBAS Xwizard.yml Description: Xwizard.exe running a custom class that has been added to the registry. The /t and /u switch prevent an error message in later Windows 10 builds.  
LOLBAS Xwizard.yml - Command: xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /zhttps://pastebin.com/raw/iLxUT5gM  
LOLBAS Xwizard.yml Description: Xwizard.exe uses RemoteApp and Desktop Connections wizard to download a file.  
LOLBAS Xwizard.yml - Path: C:\Windows\System32\xwizard.exe  
LOLBAS Xwizard.yml - Path: C:\Windows\SysWOW64\xwizard.exe  

MIT License. Copyright (c) 2020-2021 Strontic.