Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    18/02/2024, 00:19

General

  • Target

    Nezur.exe

  • Size

    26.5MB

  • MD5

    9368fd67654ec71b2d52dd0d8fa31bdc

  • SHA1

    5550c19ead9a17988d30247b646be69b776cb693

  • SHA256

    bc07898a6136045b88ae61abdf5cb081a4b7ad792c555afce1c42b3ce43cdf0a

  • SHA512

    e6f06371262b4de8ec57800c2a06492f1e977b7a05bb34258fc1d27ab11cb089776fcca6bffdc64a407c222a5b998d5a36aedc829342baf50707600912268ae6

  • SSDEEP

    196608:dOM8Wb0guhegb56w6Vr8utDq+S0KW1Hs3VaTnJ45/9iD54+V11bFv4ztbK+nmtzw:dOM8heg+YB+S0KW1HlTqzQw

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nezur.exe
    "C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=7.0.14&gui=true
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2072
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2604
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1348

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      39f33b03c51b9c4cb1ec4bd6393230cf

      SHA1

      b149fa3b70c166b3a93589761ad0c065a0142c40

      SHA256

      0554d597d6b01da4976960341e9b1b34673631f6716edbbe30119d709bbd41d9

      SHA512

      e8c64ebc5c78fb33f4f8ca4b89572eacf8bfea2e72b5d7216a747985d3c22e52c8518eeffc4a5477a3a6c4af63cb49c68c734cb55098923f07a157c27b821799

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      22039238e26705b788fad8d9dcd66ce1

      SHA1

      4bfbb4457275db0ad2190e29eceed1327304581c

      SHA256

      2b848d675a335d7c5aa886b3ec6d99643d457da1291df7800fc2ad001d1237a4

      SHA512

      ab735dcb79a53f35b09daa3f2fc42ab958e1da1a0c06685c551fd474e6b7195d72e465e9fa22040d624cc229fdfb3b02d56ea9fc234eab2fe8804229c1966553

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a10adc17dac71ce5d1233ee854eda055

      SHA1

      790cc6a60a68041ee5224567eb5e98435187d40a

      SHA256

      f72095a0c5bc7b534c6f79ae1062f880fa6ff0ee6f1f9afef6baa75f6c4379c6

      SHA512

      1a1bc65dc4e60b57d1abd274bc347b0607ca3394b455ceeacdf68899c905fca7044525af79aef1186a0281820817dc39bd9885f05a641386eee21dcf18bb3f43

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fc753556252710ac5a0229fe2886cc1b

      SHA1

      7361f7cd1759989dc73eca4764a21b67f5c21ced

      SHA256

      89bc48c80ed33865e1493c56bc952238958147f88d253a6a6d88d639e87b8322

      SHA512

      7f7d72d64d897df60c8ef66d05ed2c5d8a9c1f3bc981e67489b3bcce4a08d46d4e25cd7ff1a712642c362da7c8a75630e905895979771e1f4289b648cd6d83b1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9e9e33b67df1bfaa13b8b894bbd2ff54

      SHA1

      2cce819a99196eb8d95919b26506e73711b8e9f3

      SHA256

      c6c8c00fdeb18f37aab74f23c3dda65617738ed129585b7f8a7118cc08f6598a

      SHA512

      9b8d9c0296a6e69330b1da13f2801f243aabe4940e354f22d201399719a674b0b90aea4a493864e5d6cf86e76457139166648eb4d7a76ac560c32a4d04500939

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      085619687224f3dcdbabf6a1834038d7

      SHA1

      c7ea1f236b3137695a51cea857369f6663e8d4fd

      SHA256

      bfdc2240c44c5ae59a72001d0f667dcab8788fb01c154e806a9470a6a88e74e3

      SHA512

      2dcf976288edbee2d129a8c4066926286e8e7c957464339343efad764d92880680f9afc4c185fd140a3e9518951ecd98f17f92fbeac31187ef9d57190bac784f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9911c6bc72aeadb6f056d181aebd7846

      SHA1

      1302a27a9729b26941f06cab9da555ade9a45ae9

      SHA256

      c5eee195ed968223adf994e1ebb229e41f4b10f67e9e411e3f15c68ddd6648d1

      SHA512

      1d06d5c59a25cafe8d40337577526b4a7e04563ce0dfcf6966329923a4d449a4a9e77d912524549a234b4bede23847991f0e38325413661be01943524749bc2a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      06c6c53de7ba049ee0c98bdcc3ab9fbd

      SHA1

      226b015f8eedfa48aab18d608e58095e40a5a61e

      SHA256

      1a47fc6600e6d1ccb76f7c006a7b0401587a033679be77d2df027fcf73f40ecf

      SHA512

      ebca4995206f329d7ddfe18794898778a6138a4fab7bcbdf51212cbff84cbd34635234d522577dcd888b9348208c884baf85a89b69cf97be36dff66ed385d032

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      03048f7b9bceb8fc3469e0b89e94ebc2

      SHA1

      984e8b40207645952798cffef04a987682292c09

      SHA256

      be7d2e5af3fe99af74105e75470e7b62652c48fb65568f86e0bbee9e5668b1e5

      SHA512

      78c962b5867006272d0423d4602ac50a92a6892baa0d4a93d5f1a9aebd0f405aa9bc08597beace45cbc472c7677527773ba680ee1eb1a8865aab2b94b105b49d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      bf28c169cd235379f9289cb4fe611f36

      SHA1

      93e1bf9cc472c653c1536d00d394a7144744635f

      SHA256

      ba84fe94a4700d6e1ce898202529fe4aa9b5a30b507e1d86dd4b3e253540f00a

      SHA512

      2a615c85e3b7ea54ea032a7e60f9479b5197af50d2eb4c810d54d76358dc22de9333cd4bf335e2512ea7767136c6b6afd52e15bbf5b844e5171f77f17bb6704b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7f6c0f1d6c5997f06bb8c963f5edb97b

      SHA1

      b3f3031cc7ae7e06043ec861e281b538fdcf0877

      SHA256

      7d34d0498dc9c89ed0ea94b8707a7e6ee5d4456c34e84e79c953905787e0be79

      SHA512

      b385d2534bde3dde923503149c2c099616f69a3936100311ef6c4d0e91c38d79c061ad8b3b4ad4b56ea0f3e002f488d72abb8458283c6691352b91deb75e301f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ee78d1487382f817f7015c1b3fa50223

      SHA1

      f5cc25ddebbe2f86db3b8be25bfc0f055887b39b

      SHA256

      1462ab771714e303f25ee3c9c7283aaeedd863908e1bc21c26b435728b724a79

      SHA512

      29cf0e6c8aed91e4858877d4c9d6d198a0592ae5bb94412ecd8dd44f47bfc48ffe91cb92f4632f8a809163421e47357cb2ffd9c46ff250a8488b09e67a6a7979

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9494f7f30bac0037392dee69be758516

      SHA1

      f21d44ef5bd7364ae6605c4c8884aff5016f33bb

      SHA256

      9f52e02e75c52d9e366ff70a92d41fe6caae10a3cc0e4993dceb3b9130b3f09a

      SHA512

      cfdc94b0edebd7cebc4a75930ea0ca2c9f2999fa8cf2cdcf9f541618f5cfc834eefdb3b284ce61d6d7c33e3a1e8bc4501aa8706b4c5d69f03a318043e5b41856

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0cd99119cbe2a2eaa9845bf766324b03

      SHA1

      417dcf4ac1dcf5b41d525acc2b708a30d2d6ae50

      SHA256

      1fa67dd5a5c53b7199afe7bdbe5ceefe95db6d2407e43026e3e60ba2af76464a

      SHA512

      cf022fee828badbff2e45b9ff18f6c5158b723a472a1e33f56030328d01c8267f7ebd5d3fbd9409cb8026b88a5b8f57f049696460defc3fc26fe88c468281d26

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      800bc815a1a206465d73d6cfad2c10db

      SHA1

      b9d8a05ef5e5bc46f3601435b77cda7a10e3a12c

      SHA256

      1a42f821719b188331a88e0d8827689fd51577d73d28c68ba424513e4b8d87de

      SHA512

      3fb0ba65289e8606b98a6fd561b29c87b121183452104f6e6d364061aab60b53548b1c822c24447e0d3ec48782c0e453f182e34a8e541def7ad3d99b47ac6906

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      643613e6e135b7ac6c4ec61cceeb01d9

      SHA1

      00ead788ed22f70c1f59ef344595464cede00c47

      SHA256

      dcacc1ba3ec33b55107a5213df99f1c7b42acf9be1355560f4dba51b7e8ba9db

      SHA512

      50bbfa868a709873096c76355d56d9bb41dc689a71c39c16cfa4885259520a0f8e91bbe65bf1b7c9c797f4b0936456bb761e9db223cb531a62d424e987e8c813

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2e93201e959b5e1ea4f8ecc9af43e626

      SHA1

      986e6433cd264bd8fcbfd17e4c7e198051c2f0b2

      SHA256

      2f19d84f1212c0af8a102fc0965467fa9fbcfa4b4fb58095e9c8398826287640

      SHA512

      6c4040bb67917ac36f0df84dadf3f97e9b8c757c45752beb73b657e266b52ac6c8a36121efdba9b983789b70b25c555565b8f25c07e11ba13fa37a0c50e8c43f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3aee74863fa041f25857251127404f49

      SHA1

      e77c337dd0d252efbd91a0134165169ab5a0644c

      SHA256

      fd7458ab4bc90667dd35bcfe542757d7a3fabda55e234fef9512775e1032ef48

      SHA512

      61ecde83bca042986be44217fbd521898a97729ca967c70b21338e176755ebc06810d79082ef0cd5716a7d1c951976c5645469a154bad6d8ca4df5ccf47e6eb0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      8b529595561533de0a1cf32902c8e3fa

      SHA1

      03d7c732c2ba62f0adfa35232b99f33e30d13cf5

      SHA256

      cb9fcb43d6f224ab0f7059a31a857bca8351709e0c76b057b3e384879969b06e

      SHA512

      4a2ed9efff94c8669ca36d4b1be4724c6e79cd516df563d6130b635986bdc78229da84a4c18c4d9fc770c245b7619b22b6485af513a44df6cbcc0c8b3d962d27

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      061bd51398fd8b4f6792d01339c83de1

      SHA1

      e7d7b5aec9b99d095fdf6d8b5f0993742f80d5eb

      SHA256

      17e66a12d871713c562561f3b3f85479afac7cf9ece25a7ce751db9da5730131

      SHA512

      11e979da47acd4ca8075a6c2c21d893e305cce14a1d46a0c8ac6ad604f1392e3d494d2c17e22bd17d3b498fda314b940bdaa49ff787c38d9ecfa3e139cf632f7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      735f1e659c1218a99b90256773c1a550

      SHA1

      cbf6cc5002136341b88b39183a90ee101c82782b

      SHA256

      3d1762d1e2fbbe3b47198f3adc22a089426b366d50d38b189fc6bad1e0213382

      SHA512

      9b01dc4d6618d609d81bc217dc5a524720f6616e4f61068d17e96404fa7d4805f6893183ab171cdd065d9dd59f6b7031416a9b6572369c3cd20ccd7f00320048

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      598abde183c7009eeaacec2393c3fcfc

      SHA1

      82c3ca44f811fa2347ce1847801aae9ae8a1cb96

      SHA256

      1248702a680c1adf3485d1e5d462d84c7882af41e313e87ba408e5b7d5c162cc

      SHA512

      3e15326dd2776c78e6a28fad6df1f51797457e3a5cfcb8fbe8f6cedee865a1199de840e7eefb1c6ea3262587ec7cafddf779f743333822ac7886a3d3a7ba9179

    • C:\Users\Admin\AppData\Local\Temp\Cab30A4.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar3152.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06