Analysis
-
max time kernel
156s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 18:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe
Resource
win7-20230831-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe
-
Size
357KB
-
MD5
aef59fa091c1ee0d92497a689d5fbae0
-
SHA1
4304199e6fb6dc876ddbff6cbe75b0e3c1e1c74d
-
SHA256
0793b34c9b54fbd7f606adc2b059216fb54d0fa0b3b026503c5579228b719a94
-
SHA512
5644e9c30f5efa09890bd00f9944a90d5971957fbb91cbed98a58496b779339b48b346f57c647f8f1c6dd9aa9ba6cadfa00984d4a494f2f521b56ffb6ad1e4ed
-
SSDEEP
3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0CHGcKq:RqKB+tOkWKR0iJ0tq
Score
9/10
Malware Config
Signatures
-
Renames multiple (393) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\CloseCompress.docm.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-TW.pak.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\kaa.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msadcer.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msaddsr.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp NEAS.aef59fa091c1ee0d92497a689d5fbae0.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357KB
MD587e2cf6536c1b3fdad412c909aa719cb
SHA13243c6e08c6a562c61c95e288821da8927e8a51e
SHA25609f0d7eabaa4dd85d04209cc314fe022d31bce014258a324461d97a2c2821b72
SHA51237ed4e76e62d3a24ec545ccdab73ad2159a87e5fcdda62aa99fb5257ab7162e4acf034361569e538a4934db9af85e55bd585dcaeac10b1cefd5cb2ba2794063e
-
Filesize
358KB
MD51c5e06f50faa1d55b5134ab6a06727ae
SHA125b9df91a6faf8eb3379924e4d7ae809cf01fa36
SHA2568649e6f0735a856806d2781ae802b56d3c0224f77bd0ec9e20eab230ca6e56d8
SHA512f4af5613ba1c0d1f88db70c1cda66e29ea75895d569e3c2e71f0a1870e9942f458ecd1f020ef03788e271e792cae9cb669ae7e43cfe2dd8a78e7a9c73aa23c17