Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 18:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.02f2112b733fa2fa29781003244fba96.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.02f2112b733fa2fa29781003244fba96.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.02f2112b733fa2fa29781003244fba96.exe
-
Size
83KB
-
MD5
02f2112b733fa2fa29781003244fba96
-
SHA1
df10bb4b3472a8d3be53808af5dbdce63750c166
-
SHA256
8c4deb2c30a80c67af08c6b43f512cf531f4ce14532b787971ee6475970efb31
-
SHA512
32b87e7c13c40a5525be3ba23d7fcef518a5cb096fd5f538362a9f1f70b62570d0cac2ec7d5c1baefbda0968cd7b84458f33e7a9ab5aa616b31b9d6e6fcda027
-
SSDEEP
1536:W7ZhA7pApH9QHwtRF9ESWu0SWutlggalggEpVp4SaPmPIdq:6e7WpHIyRF9ESWu0SWuDmhSauwdq
Score
9/10
Malware Config
Signatures
-
Renames multiple (1705) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javaw.exe.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-phn.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\7-Zip\History.txt.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ul-oob.xrm-ms.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_es.properties.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Java\jre-1.8\release.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp NEAS.02f2112b733fa2fa29781003244fba96.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5d5768df764a708659b0cd5698a628021
SHA1a9f506f40ec89762698b9f837171dcb387c78821
SHA256b144235345da8e35aecdffe84d8e04e8176966e877e2d69223151803a6277f3a
SHA51299b5a12954f30763498eadb35629f24553e6f4beba89420102d0407b88b390a3f30c00a0d5b2df9a0f457f1da6102f2b8bd958e2d62a5d67883fc0b77756f5c1
-
Filesize
84KB
MD59d2108261c367d15fd57c86313efecbe
SHA1a63b3b0f5c2e0ab7ab087d5a6da8a06dbbdafd94
SHA2561910f40a9043dc4096062d9f1162bea8e3c9f3c5d5abefb532703452bd9258ee
SHA5128ac30948aba78a129800493c84a7a74fbe109d3d9b95fdc26675d7d4b20bf27f005485a563a6de0359999fad1db9c4a12bd9e2aafea82844862df415fa0baf40