8fea0e81fcb8b7081093095e26d13d957d5f14623bbc681008c5f53bfae467ba

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
Size

210KB
MD5

ccc1eb5c33b8b88e454a00dd6b257210
SHA1

9f19aa5e48c60caaf130b5996158d4407c228d7d
SHA256

8fea0e81fcb8b7081093095e26d13d957d5f14623bbc681008c5f53bfae467ba
SHA512

fda1b54ae1ad46fd8bd4f9b824b73cba46740046992ca64f07d3da59cabdff77a7310db03b785106d4a52cf86c736d232ccd0a17a412d4e1aa89409e80273238
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l5Q2jEj626ZmZMreUvreUX:RqKB+tOkWKR0nQ2jEj626ZmZkeUjeUX

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-xstate-l2-1-0.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\icu_web.md.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-pl.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems32.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-environment-l1-1-0.dll.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.ccc1eb5c33b8b88e454a00dd6b257210.exe"
1⤵
- Drops file in Program Files directory
PID:1288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3811856890-180006922-3689258494-1000\desktop.ini.tmp

Filesize
210KB

MD5
e2f002e9c275564c3444b35e2eca543b

SHA1
cbd2f7e94c81efb9c68ede1cc4e3a6a39d9c78f8

SHA256
830e1d14f5b1d4c1e5df6006bd3d6d4120b2e2dc39db61f57279014805ee4942

SHA512
8356a31d96e4ebd0386cd276ddbe146357119bd27ff05c671ec473a7cded65d9e6cdd1706610d99041786c42dbcb2aaacd0811aefe8248e540955fe2d265dcf7

Download Submit
C:\odt\config.xml.tmp

Filesize
211KB

MD5
6b7810d23d2943498343f2ee42723727

SHA1
a3b27749623b54d1d88ec068fb40d0c802d16afc

SHA256
4d0696ce9560c778bf33fef71b41c6f2fe8f7ba6a65ec1c7e5ba694e701dd117

SHA512
3ea2936dc66aa02807c34e7ab8c4a6a6e177cbf2a440c0347375c0125f7c9b903980689f71cdd93cefb467136da8cc3097d36a678ef535117429e2b264f81ae5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads