Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
82s -
max time network
92s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
14/02/2024, 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nezur.exe
Resource
win11-20231215-en
3 signatures
150 seconds
General
-
Target
Nezur.exe
-
Size
2.1MB
-
MD5
42bd04e83665ea92af6b351681bb4ce7
-
SHA1
9f46ad12d8460f0622ca4a02f4ca2350b6f47815
-
SHA256
500558e22eb61ea7e40d6a4dc10ed1a54bc2a18d08616509352487b595199a05
-
SHA512
8eee3a5d4f6d9b556a555b81eec62ab5cbad1d25b9b5983d41df08803d426944b17380fe3626ae44ba9237079a9cd588b734d2ce5bdae60bf83f9d2ec4d891a3
-
SSDEEP
24576:10fhmgWqDMrP/O+h+9s1PoX/eJF6XaC9g/qfv/GSIOTatUYzhxzCEkXuSP9fj4jt:YMW+hus1KZmiX/IgaDqISP9fjQ
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" Nezur.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4648 Nezur.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4648 Nezur.exe Token: SeLoadDriverPrivilege 4648 Nezur.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nezur.exe"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2404