70f0763c52af1ed62be3d37285174a0c702f495bed3ef0a858460b267c966507

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 11:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
Size

123KB
MD5

f138042e9fd6571907ca5eb075c9ada2
SHA1

151700118a69c4be3b18a91dfbb6e3679e7c71ab
SHA256

70f0763c52af1ed62be3d37285174a0c702f495bed3ef0a858460b267c966507
SHA512

592ed669a7b76181e26dc27cb38c753ec100a471b7a5d0d05a5cbf22075d4a11f0314b119c33bf6b7a66dc020665ddf58fa9c5d0952c603cb43ddfe831591a25
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmSXrw3Mtr0sitp:RqlIyFESWu0SWu2sitp

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2750) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2iexp.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	NEAS.f138042e9fd6571907ca5eb075c9ada2.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.f138042e9fd6571907ca5eb075c9ada2.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f138042e9fd6571907ca5eb075c9ada2.exe"
1⤵
- Drops file in Program Files directory
PID:2964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1873812795-1433807462-1429862679-1000\desktop.ini.tmp

Filesize
123KB

MD5
7be74915de53ba3201dbee49155f5b41

SHA1
f3a85d7c6e5cb47d2708ee410e8f65590bbd0b79

SHA256
ca4c18027dec5fb316a05bc9b37fcf9805855412ce942380796bf4555e6a1da4

SHA512
cc3dc75e1dd01501e3f2bcfd2e4635a6f93ad742fddeb3023dd53539f21dff1a5406f976ee2867ddf58a185d47ae242d8544edaf4a9477af4ac27a2c1920d60e

Download Submit
C:\odt\config.xml.tmp

Filesize
124KB

MD5
fef0fcd64b6e10d7fa71c028eba13791

SHA1
80c1b3f166ec6a380d1da63ad08b846bf3294c39

SHA256
c8269799a9f07753641a6f1925e5b3fba7e4c9d037c7c67b5bc2b7552214ddd4

SHA512
593767cafa2f15d1f3a9db93bdcfdb167a54292b315823ea47c57e45a69294a0e3e8e8fd1acf4ae520ec2e31cc7d02e77bbf1ce993ca0f7d61f44cabd579ae34

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads