Analysis
-
max time kernel
174s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 14:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe
-
Size
92KB
-
MD5
5e4dc53f6afd4e445613ae981f04ca01
-
SHA1
874f67983aaaf97a47494ec7f4c0c3fd1b705127
-
SHA256
df787bc7ebfae0e791b3843058bfb7a1508c970a2012b393d2b63584252b51f9
-
SHA512
d3b3c57e68e10bd1774557641d2856496e42d12ef4303e51c765e3370e0db9035b4c24b0aa809ef2f91741525af31eba91097b179762a797cee7a1cb6839e97a
-
SSDEEP
1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggA3X4lhkbwdGlgGlqEp:6e7WpHIyRF9ESWu0SWuDmSXrwQlZlB
Score
9/10
Malware Config
Signatures
-
Renames multiple (304) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\History.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\InkObj.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\7z.exe.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp NEAS.5e4dc53f6afd4e445613ae981f04ca01.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5fb46a76970df938d1999149b95b68e43
SHA1dd5d859a4177e5eebc2556b9cc67638b16da694e
SHA25601d526c1dd560229c6ebd96533b6c350039798ee738ccd914b19520cdee092bc
SHA512624876b7335cf8db953008645db3fa99dc56ae57fab08da51ec0daae615f64757481152c5b46ebd39e02d6c0a119dac88bca191d32a745432244342ce5fb472f
-
Filesize
94KB
MD596453cc307bcdff1f01783a74536b95a
SHA1fff6a6f8167b7b5d59f9addfec75395b61d9e300
SHA256259915bcc52db33fd66e8a2500e5030d42921064586b6fb9c05beb3247ad7428
SHA5125834cfa3969bb712d3a446a35919037e94c5762da0411a89135eccbe33c5d22a7bffa9bfa2c9b4ee4daefe35c3d606b348f2d40a25c7a996c11716c2c2b46f69