Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe
Resource
win10v2004-20231025-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe
-
Size
177KB
-
MD5
bdf80f2eabb2ce9dc137564c85e22f80
-
SHA1
ab85c955d11bcc4dd0fe65a0b77212f541101bbf
-
SHA256
75d685eeb837471023b582bb170a3015bf5c8b9c9e0f51f5a7cb13ecb5c51aa1
-
SHA512
4ca54f3ee774118b2e7cc2b89ea7067bff9a5fa188acb5c9709db408e52bd0ca7f741c59a618a465f1393930034715b59ff5455cd8567154369116c3363ec87d
-
SSDEEP
3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0lBArR:RqKB+tOkWKR0iJ00
Score
9/10
Malware Config
Signatures
-
Renames multiple (837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\an.txt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-handle-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\7-Zip\Lang\mk.txt.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hr.pak.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp NEAS.bdf80f2eabb2ce9dc137564c85e22f80.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178KB
MD566a2f7ffe20ffc95bd995f46cda9c567
SHA1f43cf3e4bd2f3afe83884e1dbaea617e6787f4c7
SHA2563fbc748a4734703309763556f5358b66fda0489b35373b4ba0f89a7b7b6f1580
SHA512d7bc7a23ea6084ef9666421b10f2b375f9971f919520c8650a7eb5be534e571005f31978c991f43cd24c9a126add14c3a8c4b3e8e58e005fadcfb4bc81fd9630
-
Filesize
179KB
MD56773fce44570235ad5e809924c6db7f7
SHA11ad199d8bef8a0e9f647e32c0cf0377ff408add9
SHA25640f71d1ce14a8c9f136ec48d8b010369dd351ee1f812c1da5dcf547d7ca99b23
SHA5126c5d4811a9333019505dcad62b0e83cfb6a15b09101f668c013a204dad26708b2dce6bde2abd22bd8ab3bb7b3aaa03887f0770e25a213bd6f6d4cfe13e7fba24