Analysis
-
max time kernel
159s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
12-11-2023 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.07f83831c8729aa1124aba2627bd393d.exe
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.07f83831c8729aa1124aba2627bd393d.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.07f83831c8729aa1124aba2627bd393d.exe
-
Size
107KB
-
MD5
07f83831c8729aa1124aba2627bd393d
-
SHA1
c77cb1036ec196e4f77c5e49c156f558fb9b97b2
-
SHA256
1c52352bc0317b4dd51150406368a8113a9a505084f4cee963b4151507b7e7f9
-
SHA512
1e1dda85bae4c77bd7ba1a28cc2dad913b07c7efb2170eab3e757dbfcb8862fb9b7168edd7eca88f300072abc756de268f78943fbd81ae0c1455385ed028e861
-
SSDEEP
1536:W7ZhA7pApvOsOKw3X4l9lX/JqiAwjOCz775R:6e7WpcXylXx1jOK77b
Score
9/10
Malware Config
Signatures
-
Renames multiple (1714) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT.xml.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\gstreamer-lite.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\optimization_guide_internal.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-ppd.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp NEAS.07f83831c8729aa1124aba2627bd393d.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
107KB
MD501bed58c6fb65d27b20043bc26de2205
SHA1430797b5a3a7908136d193bd8d79cfad4ddce9fe
SHA256cac5c8a4b0660fc36a2acfb935662ae56c0cdcf77fb0610e3f303000ca653cb4
SHA512e2689a645871b01cae9e273ee012d89e2b335798ad2fbc6d17bab8fa5608c942ec220c36bf7ba7de146e203857bc7cb1d9f47bac70bd57c8d38b7e44f4520bc9
-
Filesize
108KB
MD503edc07d1fc8ecc7a7a29651aba624bd
SHA1d8d58351873001b6f23d49d74273ee9b4206caf8
SHA256b4268746567986fc366fd591845d112848cfca79c8748d61b0172a676b14773d
SHA512bfa6706d468a43c88b01d239fdb29abee7af036d8fdbe400ce2ed507dc935aed0872108c451d6278097bc0827a1ca0afe9f83d2c57d9782e23c26bc854f87cdf