Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/06/2024, 00:32

240616-avlttavgql 3

16/06/2024, 00:27

240616-asanrsvfqq 3

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 00:27

General

  • Target

    Nezur.exe

  • Size

    7.8MB

  • MD5

    cc950ea8c02c620601f65b9048c4df74

  • SHA1

    ec7caa93fbdf813cb67f14ac956ab91633a09e4e

  • SHA256

    64bf358b68cb4ef856218f985948a4a196797007fa2643473902fb94c1c4198c

  • SHA512

    d9971e2597f3f3ab7ceb04274a8628ce9e5dc3364619ea01db9cd8b613aa52c067cc39f136e0e7ba10f8dd3b8ad0e110e3e67c26d164e41e53f9fcb3ee569b0f

  • SSDEEP

    196608:C/xEEFlhbjsCmaaqULXNfwS4IlJ9aY43kP:pwjsPqUDeYbav0P

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nezur.exe
    "C:\Users\Admin\AppData\Local\Temp\Nezur.exe"
    1⤵
      PID:940
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:1804
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffffba1ab58,0x7ffffba1ab68,0x7ffffba1ab78
          2⤵
            PID:1968
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:2
            2⤵
              PID:1692
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
              2⤵
                PID:3220
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2280 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                2⤵
                  PID:2948
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:1
                  2⤵
                    PID:2268
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:1
                    2⤵
                      PID:4432
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3636 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:1
                      2⤵
                        PID:5100
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4516 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                        2⤵
                          PID:4828
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                          2⤵
                            PID:4508
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4748 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                            2⤵
                              PID:3044
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                              2⤵
                                PID:1600
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                                2⤵
                                  PID:4132
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5016 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:1
                                  2⤵
                                    PID:5000
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1580 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:1
                                    2⤵
                                      PID:4556
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                                      2⤵
                                        PID:2652
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4880 --field-trial-handle=2024,i,6612765381500466712,7008249249849949408,131072 /prefetch:8
                                        2⤵
                                          PID:3812
                                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                        1⤵
                                          PID:4756

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

                                          Filesize

                                          1024KB

                                          MD5

                                          ae78984688bad532c4b71ec4da822f3d

                                          SHA1

                                          64ee212978d5a0fd7578f380a50fb6f6ec0a0ca9

                                          SHA256

                                          17f2e5d353360de2bdb79616bd05d6cf9a96f09e949ec3c0de4abef71fbefc92

                                          SHA512

                                          6f1303cd2d05f551859cbd486c81377a47ca3d2da9ace7a85e76974599f8666507bee8a08764f493e416185d5e2c8477c0ec24969a4bb25146c7005422c35aaa

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

                                          Filesize

                                          1024KB

                                          MD5

                                          e3726be5903bdc3e755a9e49b13b4d75

                                          SHA1

                                          5bb50dda728ee519d473bc9691878ff2dd113082

                                          SHA256

                                          c710a0335a5fa28c7c208872aca114129517ff48ecaf6476e28ed4f52e3a32f2

                                          SHA512

                                          e51c2a02621075920a8a4b9584457d3f3ebacb70ed3709c105c53933781f2fc1fe682fa114b3b5a242cec1429655e392222b962f5923c58ee864089ec63234f4

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          336B

                                          MD5

                                          a3daa858ee259a9fa450a960ffd83f7d

                                          SHA1

                                          04ca0c859f51c4a868b4e4eea034ac0e34c68e98

                                          SHA256

                                          f324b826db4311e8c38647ce998c6a52832e48052b444fb5649267a2c5eced98

                                          SHA512

                                          d68d7e479685258db7b8d391bb2e82823de73dd13cec2c9bdb83c1fd30cabbe60daba70a6a2290c17c65ede9514209d2c93b908be9a7364665124b1f9a926ffc

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          72B

                                          MD5

                                          305de154ed63afea0a6c15e5456b6d4d

                                          SHA1

                                          5a119318a2ad0ec65f51ab845feda61c91e9b91b

                                          SHA256

                                          297532f7234ed119f5b2cd9e5db05bede5df2c86ce9867c30994de6c459fd1f9

                                          SHA512

                                          2a2ef7ffe646c96b09780ea7dcd4f47d37848844cd0c93e6f2789e4eb2a6cbfb70516608a945b27c1d9d9eef306754fc0334cd7c10a9c02a3ff8e334c95a81db

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                          Filesize

                                          2B

                                          MD5

                                          d751713988987e9331980363e24189ce

                                          SHA1

                                          97d170e1550eee4afc0af065b78cda302a97674c

                                          SHA256

                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                          SHA512

                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          354B

                                          MD5

                                          9a0a1f14207d628cc204bf297695a532

                                          SHA1

                                          349ccd4f08e353df99fc6ae6112c2bf20fdd1b66

                                          SHA256

                                          8c78454829c3c6f554d5b9506863063ade5285271efb144007aaf8b39c09354d

                                          SHA512

                                          54d57b081eee8c4f15c2470550614bbf148295637c145c2e23b4d90e554fb03fcf6d84f24c15a890c7acaa370e97a16c7f890ce985bae15c5da0daa55f2471be

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          354B

                                          MD5

                                          cd0f5adafba7e8ef7aff18abfe067227

                                          SHA1

                                          dcecab594d75f0a469422ec51b9046ea0b7d295f

                                          SHA256

                                          effb5343a72d710fb25d341bd27de9c3bb63f11904fc466f0b1ccc18266500b4

                                          SHA512

                                          3da02ff8ce4884721c8ba698d6c91c47138d7669d8e69babe0abf121f324a98399b024a95b87343eb5db3d956964649407ecd8861f2ec385495eb3d7e7464b2d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          849B

                                          MD5

                                          023d741e3b71eb6d890988291a8e9129

                                          SHA1

                                          bd6993d38ee6687abeb5559828ed7c3fc7061d6a

                                          SHA256

                                          439243c25f0119f2befe25ff46a51834316dd5e55639d43810ed0fb2391154a7

                                          SHA512

                                          1a2a6148fe76dc9f74782c6c224756ef0a07881b84b54f5aab4db39d068b320960e5416ec1eb713da3fd0a1d070b40dcbd79a7b55eab5ec5660ad086b77a9797

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c179172d-27bc-4b31-b9a0-e1ffe5634607.tmp

                                          Filesize

                                          2KB

                                          MD5

                                          505eceb0e0d9fc3b7e1dd46a190c876f

                                          SHA1

                                          1121352cc9d4f4f39fba440bda65f82b2575fdb5

                                          SHA256

                                          d70b233533c0c7f9a72bdf65fad9475a1644d92fc9c5d69d9e4ea36886753e02

                                          SHA512

                                          fc90ef233d2cd1dc8d50aed0154e7c5584cf8d2ab048f7501f204e554e6aaa9bd28ea39480135c28e14abbdfa26dd10c2b5437b5566266db4e590339dd3ee624

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          13deeaa8eaaf38dacc4e6ad73aa728e4

                                          SHA1

                                          4fc1f55629d6eb9cb8543c04284de53504c68a18

                                          SHA256

                                          cc1d00fb939aac009b98e9814f8260a0d12e6ab48c06af27a6bc6a008c24323a

                                          SHA512

                                          4a67e651eff93c1846bda8b9e1dcc042ad898ff031f3fe8a331a65f3681586134b73e931c63126fa29d75ca0ea07c60ac996625b9d9f894dde6b00eaf11174b9

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          0f755e0ecb5f817f4144b9f96fb00e90

                                          SHA1

                                          41d5667ca98f9f91f8596e8d34238ae83e6da97d

                                          SHA256

                                          310451497638b6cff4c70837c03f3a16e2772a7fa080ddc944b3c482b91953ef

                                          SHA512

                                          65bd874c5db540c11642cac9577e85b0f166f8e9d9ca179ca74849a078bbcae859d49aaaad1b5175aa8b08c678decfbf465e7df6e8237dd97720d4a61b6ce37d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          f28f348e31b1a569675b08fb3892150f

                                          SHA1

                                          cf686702283726e67947deeecdc3f007dd5efbe8

                                          SHA256

                                          c721feb8cc2eea2a0ce9b0f428de2a5a0a273b06742df21ffaec6ea4f42f6f6f

                                          SHA512

                                          93348d05c3b12e868db45759992c06fae8f13a0a8b8bb4a6b9a351e876cacbfecf29a26d08829c40847cac25f18a8b6352d5a8ff66852d06c2af685d0d042e41

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          16KB

                                          MD5

                                          e8be317f88194242879e10c383f20fee

                                          SHA1

                                          c4b7862298253b144a481e326ab92abbd63a799d

                                          SHA256

                                          181e5c3dfafc849dfaa7e67c46ed58f400e809070c79a5846ab214b39b8f60ad

                                          SHA512

                                          a6fafa211420521acd0a43cff4c6f148a8fdb3a4f93bcac34f90a4498dffd1d4d4ab5504b60d4fd7f290a358f54dcd9001d3b1583175e50098ba12c4b36131e5

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          276KB

                                          MD5

                                          279b593f8ef2a466fe7c1dd59562f948

                                          SHA1

                                          35688d915d3b8ca06be990ce0acbe495552c65a6

                                          SHA256

                                          3a744e0f3f7837eb36ad273f4413c43b52d479d947e17f68d7e0a367071be6e8

                                          SHA512

                                          0e6baec1d2d19b0093f37a04f69bcf7d16cb531a13d33b287674c1864ef4aa51dc03185879b3dabb437cdfa6bd726ec71455be1788ace684dbd51e84dc7da1f6

                                        • memory/940-0-0x00007FF6EDC30000-0x00007FF6EEF2B000-memory.dmp

                                          Filesize

                                          19.0MB

                                        • memory/940-1-0x00007FF6EDC30000-0x00007FF6EEF2B000-memory.dmp

                                          Filesize

                                          19.0MB