hxxps://nezur[.]net/Nezur_Launcher[.]zip

Resubmissions

14/02/2024, 16:14

240214-tpw75sgb57 4

14/02/2024, 15:59

240214-te2d4sfh52 8

Analysis

max time kernel
144s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
14/02/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://nezur.net/Nezur_Launcher.zip

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
1772	msedge.exe
1772	msedge.exe
4136	identity_helper.exe
4136	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4840	OpenWith.exe
4360	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3764	1772	msedge.exe	78
PID 1772 wrote to memory of 3764	1772	msedge.exe	78
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 3424	1772	msedge.exe	79
PID 1772 wrote to memory of 2260	1772	msedge.exe	80
PID 1772 wrote to memory of 2260	1772	msedge.exe	80
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81
PID 1772 wrote to memory of 2488	1772	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nezur.net/Nezur_Launcher.zip
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe29aa3cb8,0x7ffe29aa3cc8,0x7ffe29aa3cd8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,5475256438715008669,3775799195376888322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1828

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1764

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:2104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fba38883c4ea1c000dbd9c38d017e733

SHA1
85e0906708a55073287ddfa21f757162b21c3573

SHA256
9e233584c57cb57ff648be1beaa1fff2112600fd78a0be082476c9ec5cfc5972

SHA512
a832dbfc9ed009c686cbe003fe04a67898c37f6cd3e0c19ff8a6d4af7649a8c7e36eeb2e2e4c4206752da80fbde7c26c7241a472d4098b1edc5ab4057d54f1a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
afdb5a2cf60a3ebfdb2cad1c5b4bf591

SHA1
82299eeba6941cf79d65aa0bb792942ac50b8e9c

SHA256
5b21350b404b89a7365771143c5f3aae9e8d1fc63aa3eb7f8fc54c6f705df288

SHA512
caa5724e036953a98bc9c72e213882df802ec13d7f70058372ae59cc43f2a95e3efd12a0139da66681d3513d1ca84e965d331c072e8e20997555c509470b3a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a42360ab313e85a02e940031b46958d3

SHA1
6109236a8744fade9fc659e8c8096e291833b176

SHA256
b21b8368154776b91d7e4816a0d461d43fa1a9e6c5060adff54dfe6ed90cf8ec

SHA512
d0c17813f990bab4f50e8dc267316722f7c70446d2b7dc2e49c640250d57c5f5b625be8473c41a9f217ceefbf9a042911eedb72d1fa2d7b5a35c559e8cda9197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
efc129f7c56c64580d4ddf32a8370190

SHA1
83338500197943e4664776bb30dab44545f2a723

SHA256
7e1e37311aaa7af7edc9698f7462de9b234e741d1fe6ce3caf00a47f07264af9

SHA512
dc70ed71daa285c309449c028421f4bf32b1d43efdcab2ee2cdaaf63cb3dd5e4332cc61b10a21f647eec0be2b8f0b9fcadd431a45e9c9cbd67dcbe00c8e62135

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
9172f577f1bdd3f9408c8d3d6a1950c4

SHA1
1cc4ddb7c5bdef2dc51d71fe25e455d38a8fc977

SHA256
21f87e284ae9d7f72d0ea635f46a83e652b86d8ab61484d02afc3647320c4e81

SHA512
afd4d8356873e91ca907090194cd31f7817fcf5bc700a40a2fa47434f6597799120fb5c89fbbd3f8873d80d588b58755688cc39f99a49f4448fd43ddadec6b6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb6e069c4488ceabda35433a969c494d

SHA1
f0aae762d9cc68a27ba06ab989e72e974e9bfff2

SHA256
b4596d2618115fdcf2b2a7ed47ebf720821159a575a451f6f9c684f5ac7ed866

SHA512
9b1c0f0033bb3088ba089e818c453c425afd080f0da831a0ac85da51614aba7b77cc3ad57a149d6bf2591001966e3504f00ab5921ca1881cc64b551e2723df8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1a8391e4245bf987c36605b9196d5843

SHA1
017ef988bee8d55642e40187fdf8ab00d358131e

SHA256
ae7ad56a67517f9d6f3dfdc029b690d7bf4563602a6d0f1c94e83e16182df361

SHA512
0c1c9c7116984d255edd582a4ac7df5dc6587d48f33e8b6c5045e9d5a1dd73024c87c1a1e5e59410017aa1a7ec74fe980d8397c106edfbca748751b5696ab436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit