Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 09:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe
Resource
win7-20231025-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe
-
Size
107KB
-
MD5
d15c41432b27bee9fcf50d2dd5ebca70
-
SHA1
744cffb01ccaf6924653e5b654ed8682c3e1c765
-
SHA256
33a878ecf0b07f240d2b1ae5fae92adc7e918f3fb052370b62561ba785af9455
-
SHA512
873725e99d76cde57db1dfd15a915fed4e1212889b36f5a8894d6563a944a4f78446054847ed3e69fd1a7e497330a76ff5f692383155f90d7d4b7b900f4f6c20
-
SSDEEP
3072:6e7Wpcm4HISSP4jgbEl4TWZFU6TcTSWEmOTcTSWEm5:Rqe6CgbEWToZ8
Score
9/10
Malware Config
Signatures
-
Renames multiple (764) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Internet Explorer\SIGNUP\install.ins.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InputPersonalization.exe.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\7-Zip\Lang\de.txt.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sl.pak.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\ado\msado27.tlb.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\7-Zip\Lang\lv.txt.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\asm.md.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\resource.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp NEAS.d15c41432b27bee9fcf50d2dd5ebca70_JC.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD56aef6d1de2060610cecb82286e3c80f9
SHA1dc1f0f5f9bd52121eb7e5a1f99b06aed6f3a9914
SHA2564f3dd877429a0894bb908fd1eaba69b046e4fbe4a08b3693baf6a2a9e6eb5ea2
SHA512fdc57c3e24183a4232827f6f312cdae216facb6e0b5cd0a401c457ec5961ec8030fbdbafde37be4daa6769a1eedaf599b1222132870b995d84a33d37e3f6472b
-
Filesize
109KB
MD5abbf167cdc0258dcdb0b273a9ad13ff4
SHA126065fd4e8a833b4353a93ea11a996f0ddae6198
SHA256b211dd34d327ccff668887c0678fc0f86433ab09503173c12b0429487d285b3d
SHA5127269812c6c7b1e9514c6b48a4d885e3fec5ad29ed149e627932b3a7820743f9a2e4c34863a811618ba1a13c434c61049fa536ce78c0e349aea8dfbb7f10fcc39