Overview
overview
7Static
static
7Nezur_Executor.zip
windows7-x64
1Nezur_Executor.zip
windows10-2004-x64
1Microsoft....re.xml
windows7-x64
3Microsoft....re.xml
windows10-2004-x64
1Microsoft....ms.xml
windows7-x64
3Microsoft....ms.xml
windows10-2004-x64
1Microsoft....pf.xml
windows7-x64
3Microsoft....pf.xml
windows10-2004-x64
1Nezur_Inte...s.json
windows7-x64
3Nezur_Inte...s.json
windows10-2004-x64
3Nezur_Inte...rprint
windows7-x64
3Nezur_Inte...rprint
windows10-2004-x64
3Nezur_Inte...t.json
windows7-x64
3Nezur_Inte...t.json
windows10-2004-x64
3Nezur_Inte...s.json
windows7-x64
3Nezur_Inte...s.json
windows10-2004-x64
3Nezur_Inte...re.pma
windows7-x64
3Nezur_Inte...re.pma
windows10-2004-x64
3Nezur_Inte...3C.pma
windows7-x64
3Nezur_Inte...3C.pma
windows10-2004-x64
3Nezur_Inte...rl-set
windows7-x64
1Nezur_Inte...rl-set
windows10-2004-x64
1Nezur_Inte...rprint
windows7-x64
3Nezur_Inte...rprint
windows10-2004-x64
3Nezur_Inte...t.json
windows7-x64
3Nezur_Inte...t.json
windows10-2004-x64
3Nezur_Inte...gs.dat
windows7-x64
3Nezur_Inte...gs.dat
windows10-2004-x64
3Nezur_Inte...re.dat
windows7-x64
3Nezur_Inte...re.dat
windows10-2004-x64
3Nezur_Inte...data_0
windows7-x64
1Nezur_Inte...data_0
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 14:42
Behavioral task
behavioral1
Sample
Nezur_Executor.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Nezur_Executor.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.Core.xml
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.Core.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Microsoft.Web.WebView2.WinForms.xml
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Microsoft.Web.WebView2.WinForms.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Microsoft.Web.WebView2.Wpf.xml
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Microsoft.Web.WebView2.Wpf.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Nezur_Interface.deps.json
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Nezur_Interface.deps.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Nezur_Interface.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.fingerprint
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Nezur_Interface.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.fingerprint
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Nezur_Interface.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.json
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Nezur_Interface.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Nezur_Interface.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/protocols.json
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Nezur_Interface.exe.WebView2/EBWebView/AutoLaunchProtocolsComponent/1.0.0.8/protocols.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Nezur_Interface.exe.WebView2/EBWebView/BrowserMetrics-spare.pma
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Nezur_Interface.exe.WebView2/EBWebView/BrowserMetrics-spare.pma
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Nezur_Interface.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-6758B082-4D3C.pma
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Nezur_Interface.exe.WebView2/EBWebView/BrowserMetrics/BrowserMetrics-6758B082-4D3C.pma
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Nezur_Interface.exe.WebView2/EBWebView/CertificateRevocation/6498.2024.12.2/crl-set
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Nezur_Interface.exe.WebView2/EBWebView/CertificateRevocation/6498.2024.12.2/crl-set
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Nezur_Interface.exe.WebView2/EBWebView/CertificateRevocation/6498.2024.12.2/manifest.fingerprint
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Nezur_Interface.exe.WebView2/EBWebView/CertificateRevocation/6498.2024.12.2/manifest.fingerprint
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Nezur_Interface.exe.WebView2/EBWebView/CertificateRevocation/6498.2024.12.2/manifest.json
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
Nezur_Interface.exe.WebView2/EBWebView/CertificateRevocation/6498.2024.12.2/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Nezur_Interface.exe.WebView2/EBWebView/Crashpad/settings.dat
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
Nezur_Interface.exe.WebView2/EBWebView/Crashpad/settings.dat
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Nezur_Interface.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
Resource
win7-20241023-en
Behavioral task
behavioral30
Sample
Nezur_Interface.exe.WebView2/EBWebView/Crashpad/throttle_store.dat
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Nezur_Interface.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
Nezur_Interface.exe.WebView2/EBWebView/Default/Cache/Cache_Data/data_0
Resource
win10v2004-20241007-en
General
-
Target
Microsoft.Web.WebView2.Wpf.xml
-
Size
139KB
-
MD5
97ea2301be18aefade073d39302154d0
-
SHA1
30f83ae731adcc4e79598c2c21644cf02b909928
-
SHA256
e088d2b21902cb8479f782f327925f9e3281b7ee8406966735dd932e5a58e3a9
-
SHA512
92a6ce81f5b3f4c7779bb9589d7b6548bbfde0e2ad59d1f31d190c9c75ef95e1dc31a9c763eb11fa62803d997b6af79f4f6e56dd31e3bdff8d0ba4f84c570e5e
-
SSDEEP
3072:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtLryDnLfryDYO/LPm8RLP9R3Ly1vb9QUX7:xOsSyTa4PgfmLC4uyD/D4yDC4dryDJtY
Malware Config
Signatures
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Microsoft.Web.WebView2.Wpf.xml"1⤵PID:3804