Analysis
- max time kernel
154s - max time network
170s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system - submitted
15/11/2023, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.a8c5de9a466cee465e6fb784eae74480.exe
Resource
win7-20231023-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.a8c5de9a466cee465e6fb784eae74480.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target NEAS.a8c5de9a466cee465e6fb784eae74480.exe
- Size 32KB
- Sample231115-ew6ylaca48
- SHA256 7b667e8c176d482d86417f0aaa11b9adf46fbec2212017a1be0d6287e055597e
- MD5 a8c5de9a466cee465e6fb784eae74480
- SHA1 6ce76a9c53f21501a315e4d2e2fe74eb4fd186e1
- SHA512 418975613afbe2c15032ecef644023aed7dd0e70fde5ebca753299999197a326ee8959f331da809c7829db9445641d13fdd8fce7d6509aa2a25720a593a18239
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaeEnXA+J1x5XA+J1xQ:W7ZDpApYbWjd
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (2569) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libxslt.md.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11wrapper.md.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-phn.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTrial-ul-oob.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\include\jni.h.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\bin\jfxmedia.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8_RTL.mp4.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-ppd.xrm-ms.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe File created C:\Program Files\Java\jre-1.8\bin\WindowsAccessBridge-64.dll.tmp NEAS.a8c5de9a466cee465e6fb784eae74480.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3350690463-3549324357-1323838019-1000\desktop.ini.tmp
- Size 32KB
- SHA256 dc280aadfc2e731d2c736feb95c75c1c845ca9612085abe47a534acaa2997eb2
- MD5 fc0481ed8b297c7fc663fb2a12027e0d
- SHA1 21d4df1f72c1ea33ac753281d0ae58b2864334ff
- SHA512 4c759f6329897ef72dc8128a574c3e7a780e9af3ff6d6cf9593ff4ed076fb349d44576033c04fa169853288c2959609ecd04359ca842a4e2caeac21c943c4631
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaeEnXA+J1x5XA+J1xh:W7ZDpApYbWjw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\odt\config.xml.tmp
- Size 34KB
- SHA256 dc98f8c48ec12d19463eb059b24fb66c968feab22e4c0d2c06917836ae31fb8b
- MD5 d2332f7ad5f27b61a8cf86de3c2951f3
- SHA1 48e157a58232e9355dd214ffdebc913422a73648
- SHA512 3ff7a03199b2c6b6b69458913e697f54254ef678facfc7b44d96eae3e104d780bce012401f33c5e36022a367deb1bae0c9b10b17d4737f8871b8c68fa572f089
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaMaeEnXA+J1x5XA+J1xlrQrL:W7ZDpApYbWj9
- MD5 SHA1 SHA512 SSDEEP