2cc8d9fc405d33d0fd8ee99b35a61e8e8781fac9a0a54cb03a23e3d0084776a2

Analysis

max time kernel
153s
max time network
133s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
Size

287KB
MD5

9e2abb91a693371c19ed45a34a1db4c0
SHA1

5124c1eb077f35cf5043367f86c1f8dc0f029702
SHA256

2cc8d9fc405d33d0fd8ee99b35a61e8e8781fac9a0a54cb03a23e3d0084776a2
SHA512

b646198f02e66390e817598da52c1a5796df8486789658d01a4963185d0eee1abf587bba6101c25a1f146d5506783a1d521dfa6eb05a6bd53583fd30e3f0e3e0
SSDEEP

3072:6e7WpGlYKUJTakSZObBPbl8EJrM2Q3Wgq:RqAlYdJT1bBDl8EJrM2Q3Wgq

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 32 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9e2abb91a693371c19ed45a34a1db4c0.exe"
1⤵
- Drops file in Program Files directory
PID:2992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3185155662-718608226-894467740-1000\desktop.ini.tmp

Filesize
287KB

MD5
6b1c13f646208d5d2fc48fcf9f0ceea4

SHA1
69f83c12ed7848b6743511236ee00eff9d65dcb8

SHA256
8fc9f5d4c12b2179fce2f3e174d08e26735816ea9ba778300dd4bab2cbb9a951

SHA512
73eb32e211f2bdb47c8da7573d3b3b978bf5ebad9e94d9ca4ade104d28bbac1a75d9c40bfa2f789e51dd2155bf43d82f5d72a43f8ba708c69d8aea7f02df2fb7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
296KB

MD5
eec831c6ada065d40a34617ce70f2615

SHA1
17268c8cad479e0f80eddc197721f855ffb661f9

SHA256
80f2e440dcbf22207cb3312ea5303eeb87bb90a2c1138dbc529ad0bcd8bc5b7d

SHA512
e34dda69dc1e19d44017d01989f7b354667349e9395143840d1059d14841f6130a7c2f7e68690187ef612eaf2e78eb215e9ba574f03d91f651adc0e9972c99b3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads