Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Nezur_Interface.exe
-
Size
7.3MB
-
Sample
241013-blh71a1fqh
-
MD5
c9af7e2001b94e2001a5570d3fad260d
-
SHA1
63b400a16358e589e6bb43757c84f0cdee597b7d
-
SHA256
b75d3cc9cdd39a2c4811f871efb47f528222fe49a7dc923a82d1ee10ceccdfcd
-
SHA512
b3c012666476cad91a0baddbc2f568633aeb0abc9331ff81473bb52e1c9aac1cfeb50bf90f843d290eda19bd3aac73a29f9ce6478d33e3acd2c353a8adad995a
-
SSDEEP
98304:P4QuiXvqdeO4pbZVj9JPgBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuY2:ARiSZO9S2fasv+BptT
Static task
static1
Behavioral task
behavioral1
Sample
Nezur_Interface.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
Nezur_Interface.exe
-
Size
7.3MB
-
MD5
c9af7e2001b94e2001a5570d3fad260d
-
SHA1
63b400a16358e589e6bb43757c84f0cdee597b7d
-
SHA256
b75d3cc9cdd39a2c4811f871efb47f528222fe49a7dc923a82d1ee10ceccdfcd
-
SHA512
b3c012666476cad91a0baddbc2f568633aeb0abc9331ff81473bb52e1c9aac1cfeb50bf90f843d290eda19bd3aac73a29f9ce6478d33e3acd2c353a8adad995a
-
SSDEEP
98304:P4QuiXvqdeO4pbZVj9JPgBzjYz067yqu/mnFQOi33nFbO4KSgPTPgS8NAvKBUuY2:ARiSZO9S2fasv+BptT
-
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1