a90099249e425106916fa1cde6cde37455f558a050fc76e18923f4abb3cd95f7

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.7eb44eb68bd14542d54051019a869740.exe
Size

29KB
MD5

7eb44eb68bd14542d54051019a869740
SHA1

8bad7e63b849ace933aa4ab9f1dbc27e51d0d031
SHA256

a90099249e425106916fa1cde6cde37455f558a050fc76e18923f4abb3cd95f7
SHA512

c452bd457233f51ef513fc7fcad7621db784d9d24ee68930641695159ee20b14fa3f44f659cf4f216ae3af842491b38acdac42cf2189d3c1da1dd44791a9bc9a
SSDEEP

192:tACUADIY0Br5xjL/ScAgAQmP1oynLb22vP+7QJGfQJGxkckg12t712tm:GBt7Br5xjLfAgA71FbhvP+7QEfQEijp

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3155) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCHART.CHM.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jre-1.8\LICENSE.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ppd.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	NEAS.7eb44eb68bd14542d54051019a869740.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.7eb44eb68bd14542d54051019a869740.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7eb44eb68bd14542d54051019a869740.exe"
1⤵
- Drops file in Program Files directory
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1873812795-1433807462-1429862679-1000\desktop.ini.tmp

Filesize
29KB

MD5
87e7155b4b7ec877146105290de5b28c

SHA1
abc374dd366b5b06f3c47f3357d891e5739ed3b9

SHA256
33617f24ecfa7c929df5c2ff9f9b0b4a512f4c96e66698ab30af744850ad0307

SHA512
e5e8448bdb8e7126102f853047caf1e8c8c9bd082e87bd9b55e2bb8ed42aed509985e58064331208e9cf1035e3e10a9106b68c0039f6fdbf90d48a0150754922

Download Submit
C:\odt\config.xml.tmp

Filesize
30KB

MD5
c85297023193ba8131e0a1647d025793

SHA1
bb44e72fa4ba71547135ffc25a806ab1702cf35f

SHA256
2a36a2ac1b44288b7595062577ec8b83453244ad4e2a04c5b1356fbd2034b8ef

SHA512
53cedde4437b6356460c8fc27a9eead4d95122f643213cfa5ae88df5fb917a3345d051da513e372f130f58d6bc587e2d44c70aaef5f81184e5a1cd8160c7c92a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads