Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

Nezur.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    82s
  • max time network
    92s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/02/2024, 17:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nezur.exe

  • Size

    2.1MB

  • MD5

    42bd04e83665ea92af6b351681bb4ce7

  • SHA1

    9f46ad12d8460f0622ca4a02f4ca2350b6f47815

  • SHA256

    500558e22eb61ea7e40d6a4dc10ed1a54bc2a18d08616509352487b595199a05

  • SHA512

    8eee3a5d4f6d9b556a555b81eec62ab5cbad1d25b9b5983d41df08803d426944b17380fe3626ae44ba9237079a9cd588b734d2ce5bdae60bf83f9d2ec4d891a3

  • SSDEEP

    24576:10fhmgWqDMrP/O+h+9s1PoX/eJF6XaC9g/qfv/GSIOTatUYzhxzCEkXuSP9fj4jt:YMW+hus1KZmiX/IgaDqISP9fjQ

Score
8/10
persistence

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nezur.exe
    "C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
    1⤵
    • Sets service image path in registry
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    PID:4648
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads