Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe
-
Size
142KB
-
MD5
126928b77dff7044325e0bdec4e7f5e3
-
SHA1
a247e86e8355aa29ae31761716b478176fcbbf12
-
SHA256
c79152d9adc8c8dbcbbce09fda509871d8db22aa2ceeaab2a683caaed7b3f5f0
-
SHA512
e4364f1ec05fcb5638acdc418cd700f1d5e9b073d5a283ca8d16edf100b9a2562c11ba5460732c36693efa709694a810353c2d647cf3be808b4a3544b08b3020
-
SSDEEP
3072:6e7WpHIyRF9ESWu0SWujKsKRsP9fVL9iZ76qupFg9e+eTSj:RqlIyFESWu0SWu86jYYFg9e+eTSj
Malware Config
Signatures
-
Renames multiple (951) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\jfxrt.jar.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\GroupAdd.DVR.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\InitializeDisable.tif.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\7-Zip\7zFM.exe.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\7-Zip\Lang\ko.txt.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig.companion.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe File created C:\Program Files\7-Zip\7z.sfx.tmp NEAS.126928b77dff7044325e0bdec4e7f5e3_JC.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
142KB
MD5837c8c527a0ab6c36333e0642e683fbb
SHA1db4e7d8de858d82405e8821d89b6110ccef0fa37
SHA256fdb608a8b86f75fa36be452a9aae2fef34a4bcb901c2b44f3d6afa435eaf91b6
SHA5126ee8a5bc71e0768c77e057dea5bb87810a91a1bb42c471d516d9f980a4c6175508c8edabe3246abb4595774e9ff254dd278b92b8325fddbeb72ac102da1a3016
-
Filesize
143KB
MD5192a808f67fcd5858241c612cbec0c56
SHA11e150b1b7c3fa78a99514ee0d62b3b60dcd29ecf
SHA256a7c951175035eff4a109f9d63dc1d2370af7a2dcc4253f1ab3670befd220f4af
SHA5128d7fe9f98a27e0552714178a6dafbbd9ba8dbbc878deaea3d3a6248ef6a5db9b5e54444d46ef5b7517518749153ba6355ba90136f01eb9ac54cb6221efe2c576