8288d94f7db9c1d99ec5bfc0ae206d28bc8489b8276d2b638ab50eafd65469f7

Analysis

max time kernel
11s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2024, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nezur.exe
Size 4.6MB
Sample240412-dbfegach97
SHA256 42317a2bf653554d75fee360889868dca0d1fa4cd8db24dac5e616e4ea6208c3
MD5 483bc175a855a89d93cb00577bbb7920
SHA1 55b1ca916684328da9b004083189bf92ccd29138
SHA512 3b186a5f644711634a331d7bf771cb7247a889fe65c3fc138de20cbb45f2f83bf060e6257444812d681015b8fddf1af03282a941ebd3019c5673a79cc1cc4ea7
SSDEEP 98304:URkvYI8Xa9jB6TKw/h4z+sLDuOl/+ooXE9jwzb6G:USvUa9jwk+sew/+ooXE4
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Nezur.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Nezur.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Nezur.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/3076-0-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-2-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-3-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-4-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-5-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-7-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-6-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-149-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida
behavioral1/memory/3076-173-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nezur.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3076	Nezur.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3728	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4824	taskkill.exe
1612	taskkill.exe
4948	taskkill.exe
2972	taskkill.exe
4660	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe
3076	Nezur.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	4948	taskkill.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4748	3076	Nezur.exe	87
PID 3076 wrote to memory of 4748	3076	Nezur.exe	87
PID 4748 wrote to memory of 2540	4748	cmd.exe	88
PID 4748 wrote to memory of 2540	4748	cmd.exe	88
PID 4748 wrote to memory of 1380	4748	cmd.exe	89
PID 4748 wrote to memory of 1380	4748	cmd.exe	89
PID 4748 wrote to memory of 1492	4748	cmd.exe	90
PID 4748 wrote to memory of 1492	4748	cmd.exe	90
PID 3076 wrote to memory of 2688	3076	Nezur.exe	91
PID 3076 wrote to memory of 2688	3076	Nezur.exe	91
PID 2688 wrote to memory of 4824	2688	cmd.exe	92
PID 2688 wrote to memory of 4824	2688	cmd.exe	92
PID 3076 wrote to memory of 1016	3076	Nezur.exe	94
PID 3076 wrote to memory of 1016	3076	Nezur.exe	94
PID 1016 wrote to memory of 5024	1016	msedge.exe	95
PID 1016 wrote to memory of 5024	1016	msedge.exe	95
PID 3076 wrote to memory of 896	3076	Nezur.exe	96
PID 3076 wrote to memory of 896	3076	Nezur.exe	96
PID 896 wrote to memory of 4808	896	msedge.exe	97
PID 896 wrote to memory of 4808	896	msedge.exe	97
PID 3076 wrote to memory of 1868	3076	Nezur.exe	98
PID 3076 wrote to memory of 1868	3076	Nezur.exe	98
PID 1868 wrote to memory of 1612	1868	cmd.exe	99
PID 1868 wrote to memory of 1612	1868	cmd.exe	99
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100
PID 1016 wrote to memory of 4100	1016	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\Nezur.exe
"C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Nezur.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Nezur.exe" MD5
    3⤵
    PID:2540
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:1380
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:1492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://key.nezur.io/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd148346f8,0x7ffd14834708,0x7ffd14834718
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:8
    3⤵
    PID:2824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:3744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10944376369173238382,9281211421175461599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
    3⤵
    PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://1cheats.com/store/product/41-nezur-key-bypass-lifetime-license/
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd148346f8,0x7ffd14834708,0x7ffd14834718
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,17282308249568827119,14019861754216221938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
    3⤵
    PID:3116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im HTTPDebuggerSvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  PID:2964
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1700
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1180
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
  2⤵
  PID:1700
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 750d4affccbc1b344cd3a7bbf963011286586989969352250df078ea0e84856c
MD5 1807cdfea20022a28fd62ee8ce12a177
SHA1 6f505b0df6696c6d0ce4b524d2d05f78bc5e0c6c
SHA512 f801cbcdfd0710df47c22a270b85ca002d484ed551bde7e41e68489e6de69fbde0163c61c33bbf96869375812e8251d1c2644e4303b4e7e21bcb283f35464fe8
SSDEEP 96:n+k9Lw1zE2wpvWMoiVmdeHOHTs7VUWQyV+VD7ziEwb:n+kxw22GWMXETEVrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d527e97fcfa016d7d518c754941661a0f65f65406a4aa95498c6a14cf9eca8a9
MD5 d40c5d9ba7a05a4bcc793f67d9cded87
SHA1 c5c3cc077edf0ff7dc6a38dd6d0def45f13eefea
SHA512 8bf1ad653af4251edc357461d1638b3a209ccbcc8d32d05a39c5922894838e82b9a47c91f89e350e7cf9abd9418229d64583e8f70d394a50b4f2d136d23c3c21
SSDEEP 96:n+kULw1zAmwpokXWMoitYR5mde1Fuv1nug1kEc8GEqOHTa7NUWQyV+VD7AiEwb:n+kiwumAXWMS9uv5ugbcaqETGNrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c26df6e44f329ea8e8e0712a09efe05637ba1231d7e77b49c97015beeda98bd4
MD5 cbfd5a2561f685b95176a301e0ba4c12
SHA1 ef8575d41170047b4ddddb28958b2cdfd51e5560
SHA512 bce31da787e48a3c7cbf3f7c6f43aa24fa37cd8831fd088c45769e680540123fd60227f4eaa92d0a399ff901773671afb5b69b00d8f64d52443e75bf61518a0d
SSDEEP 192:CoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2e2RUq2SjdQbR83J:W9iIxuERzA83h09RZxYYNCq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dff1e0081be1ed9a3b9431cb603f75e9894d92eb52fd435a587bac13d24a185a
MD5 55d28c5aff50c6deac6206a20a211010
SHA1 eb861d1618cb5ac0528106c20393ad736c8121f9
SHA512 983f2e28182efb7bb9ed8b5b0fea409d08e31eb5d2132b2490671e62a41793b0a60bd1a3f02acd31e5b20e41c60e0ff301836fadb5b284313df77f349e30db05
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupb+qe2RUISljdQbRKoiXs4K:A9iIxuERzA83h09RZxYJLeCKo4NYwpgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3076-5-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-7-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-6-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-4-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-3-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-2-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-0-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-149-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download

memory/3076-1-0x00007FFD23150000-0x00007FFD23345000-memory.dmp

Download

memory/3076-173-0x00007FF628E10000-0x00007FF6299C6000-memory.dmp

Download