Analysis

  • max time kernel
    153s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2023, 10:06

General

  • Target

    NEAS.9b534ecbc4a9069ebff40d7f4c785eac.exe

  • Size

    199KB

  • MD5

    9b534ecbc4a9069ebff40d7f4c785eac

  • SHA1

    1828c6a854193d728c9b32095b5dde0383118975

  • SHA256

    b1d8bb0411b32dd56ed10a9c49bbdeb13ea7f7e83df1294995c4058956e913bf

  • SHA512

    e341561eeeb1316f38859eafc825f33050c73cad3b6d9c2c28ee0b9a03ec30312245b218d5b00e8b42fc1cb26bf2475ba44666434243ff337a703df608902ad1

  • SSDEEP

    3072:6e7WpbAIuZAIuYSMjoqtMHfhfpYRY0Zk6zF+Q3F:RqBAIuZAIuDMVtM/8aE3F

Score
9/10

Malware Config

Signatures

  • Renames multiple (224) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.9b534ecbc4a9069ebff40d7f4c785eac.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9b534ecbc4a9069ebff40d7f4c785eac.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2085049433-1067986815-1244098655-1000\desktop.ini.tmp

    Filesize

    200KB

    MD5

    5cbb1ed66594bce2f945964ada9593f0

    SHA1

    8e825d1d7a4a48c582c23008ab91fc931852ddd6

    SHA256

    5b8c2caba95a910ff7bcd0a97642e9f244ccbd35988ad22cd1a8a0f924570156

    SHA512

    a9827ac7cb7d4ea02d2cbea2127252e857fe68828bfbe0fc09bd0a790e19224e7ed5de61430869130e89bad23de35406beb7701e17a2b458cc167c122871d26f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    209KB

    MD5

    ddc1138d6c07cdb5d94e507223d1fdbc

    SHA1

    898d821d36d21316683f8a641ec72087bc478184

    SHA256

    d274e79c0484273d157738bf2a5f0badb68dfff8480dcfa1c7706cb98c9c229e

    SHA512

    9c67caf5700acefd85f86c986bd6ab9dbd6488a7ca7600624ef8f7c65004d9a6af3a3e39c5f702fa5b65925873125e37f0ae10a22cc21764d4d77ab280bcb476