Resubmissions

04/03/2025, 16:36

250304-t4hcjavry8 4

04/03/2025, 16:25

250304-twxr9avtbv 6

04/03/2025, 15:38

250304-s3h21avjt7 10

04/03/2025, 15:35

250304-s1s47atrz7 4

04/03/2025, 15:32

250304-sysewatvb1 4

Analysis

  • max time kernel
    5s
  • max time network
    5s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250217-en
  • resource tags

    arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/03/2025, 16:36

General

  • Target

    nezur-faking-unc-v0-9bo7ts6at0od1.webp

  • Size

    176KB

  • MD5

    d444757770ebee84843f2922c430a3b5

  • SHA1

    ae36d68db168d69bfe90fb22f703b638070b7d8d

  • SHA256

    20be8d6207184dfd8d235813a15943d41c17434c5ba8d044f182161dca2b33a2

  • SHA512

    a242ab595865991219f8e82a1d1d4c5d01d71a308a8e4ddc4b3746cd199f7890c1c283ba9c815977938a474046d089c05b4490e5323c225d8412f0340418d314

  • SSDEEP

    3072:8ihYfiRKLglPj0xMczOFm2HYyEOEvnYONFs8jNDGCsekDyJNO3:Vh67glPj06KOFFHYyEpnLNZBrhA

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\nezur-faking-unc-v0-9bo7ts6at0od1.webp
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82ff2cc40,0x7ff82ff2cc4c,0x7ff82ff2cc58
      2⤵
        PID:1256
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,10563666902621913907,6353456478318020505,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1844 /prefetch:2
        2⤵
          PID:2976
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1404,i,10563666902621913907,6353456478318020505,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2112 /prefetch:3
          2⤵
            PID:4372
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,10563666902621913907,6353456478318020505,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2172 /prefetch:8
            2⤵
              PID:2032
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,10563666902621913907,6353456478318020505,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3064 /prefetch:1
              2⤵
                PID:3204
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3052,i,10563666902621913907,6353456478318020505,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3220 /prefetch:1
                2⤵
                  PID:3724
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4516,i,10563666902621913907,6353456478318020505,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4708 /prefetch:8
                  2⤵
                    PID:2012
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:2752
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:1948

                    Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            90430a246152f8918ebefa534ee20fd5

                            SHA1

                            a99dcd70c7ccd3a4e52a9a15f0b83ede29676ebb

                            SHA256

                            94ba04b1cb0ab459ad11b497622b2ba6c62f9c5b63b92ef8ba90af3926bd507d

                            SHA512

                            72153a9aded56bbc2e3cda94138812f1eb6e92d98bd9b4a500c702ef56225095bbd7ab6e8c3f54ba208d58f0d0e551a8347505daf253749f805ec3dc790a4cbc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            124KB

                            MD5

                            030df03792fab58971d011c5b2699de3

                            SHA1

                            fc7e669e03151b4a31c94e7818bb07a6660e200c

                            SHA256

                            a086167e9e584aa2c3d53ecabb6d5824bfe3fb186baea813c737523277cb0058

                            SHA512

                            8f0f6919c818b09fdf8db581e2f638a89aabf887cbbdc673285034a00aa262e4f0a0fbed6e8227cb17b8d2d91d6ac0346a4d1c5fbd38044898f2aee572cbd6bf