98b63c21ba0f4b9fe3995300211e8e509af8bd8a2f8655a41af6d3c83c46b7d3

Analysis

max time kernel
177s
max time network
144s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22-10-2023 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
Size

115KB
MD5

ea35b706e764c9993df67765b70cfe90
SHA1

8c6abe439914efa8a43491c0109b40a9e3486842
SHA256

98b63c21ba0f4b9fe3995300211e8e509af8bd8a2f8655a41af6d3c83c46b7d3
SHA512

8f34444c15b2d0329b9f5f0427754c5d91fd338c5e19defef86fe305dc2f2b71c922594a35df8ed7964d77a7f4d51ddd472af1f8328b8c73aac801046780c9f9
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmSXrw3Mtr0s8PJ:RqlIyFESWu0SWu2s8PJ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipRes.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipRes.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\BackupLock.mp4v.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkWatson.exe.mui.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ea35b706e764c9993df67765b70cfe90_JC.exe"
1⤵
- Drops file in Program Files directory
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1154728922-3261336865-3456416385-1000\desktop.ini.tmp

Filesize
116KB

MD5
fac22bce98ae49f99446f3f2d47c3e5a

SHA1
dec9eeaa37d0c46bbc25eed73619a845db2e8625

SHA256
ba4670862e805e534dc068b293b1b66cb023bd28134da2871955fbae42eeec1b

SHA512
3bf57e3ef12dbceff39b81a59b947434a76347528536891501b2279f74af761ca1797807f6fb23203ebde38cb61b130f0a630c7d052328878d2d79a9120b881a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
125KB

MD5
0c486538f8e578789b5bb0c430898ba8

SHA1
90348abf83e35bf291c360fe9f0486e1f62097db

SHA256
9a3d312ab3dc94ede2334101d5d6a0d140c2303891fc6d4356f04be33afa44fc

SHA512
c013ef52963c599e07f38a2bd250b175560b8c8d3a1e61f0ce7b211057c12d094e5f35209a74c407862974e5551b1d34853769bc79d598074222e4aaca6cd1b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads