Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
16-11-2023 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.10b81265235cb48dbabf45d482c52630.exe
Resource
win7-20231020-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.10b81265235cb48dbabf45d482c52630.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
NEAS.10b81265235cb48dbabf45d482c52630.exe
-
Size
8.0MB
-
MD5
10b81265235cb48dbabf45d482c52630
-
SHA1
fd406b2bff9ac4abd36e1ba6ee366cf4575ee068
-
SHA256
999b9b70d5078d72d6b018824ad58e53dd6703c1bd9fa9bc0a6ec46724450161
-
SHA512
1d004444819bef2584d16c3bd1841cf4c86085c7e4649932cd5b4087f13725c7e9dd432fbc1b1419b2ece0515254a742b55957cf6c549f170002ec16531dcb69
-
SSDEEP
196608:NoMl8D1jXgPo2S9+ULdNPtbuPZOOmnqogHh/p3k:kmw2SlLdNPt6ROOmqZn3k
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS NEAS.10b81265235cb48dbabf45d482c52630.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\32-bit Thunking service = "C:\\Windows\\system32\\thunk32.exe" NEAS.10b81265235cb48dbabf45d482c52630.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\detroit.txt NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\thunk32.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\SysHeal.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Windows\SysWOW64\SysHeal.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\zip64.sys NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\exe64.sys NEAS.10b81265235cb48dbabf45d482c52630.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\lv-lv\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\msinfo\it-it\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\windows media player\network sharing\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\help\2052\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\web server extensions\14\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\equation\1033\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\smart tag\lists\1033\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsta\8.0\x86\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\comàæ(c:\program files\common files\microsoft shared\ink\nl-nl\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\msinfo\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\office14\office setup controller\office64.ww\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\el-gr\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\canyon\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\triedit\de-de\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsta\appinfodocument\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\rectangles\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\msinfo\es-es\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsto\10.0\1033\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\web server extensions\14\bin\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\textconv\it-it\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\stationery\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\web server extensions\14\bin\1033\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\web server extensions\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Battlefield 1942.exec:\program files\common files\microsoft shared\ink\bg-bg\Battlefield 1942.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\travel\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\arctic\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\microsoft office\office14\groove\tooldata\groove.net\documentshare\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\quad\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\sumipntg\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\office14\office setup controller\access.en-us\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\textconv\es-es\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\textconv\it-it\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\themes14\strtedge\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\program files\dvd maker\shared\dvdstyles\flippage\DVD Copier.exe\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\windows sidebar\shared gadgets\Windows XP crack.zip .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsto\10.0\1033\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\vsto\10.0\1033\Norton AntiVirus 2006 BETA.exe\Battlefield 1942.exe\NETSKY SOURCE CODE.zip .exe\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\NETSKY SOURCE CODE.zip .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\ink\hwrcustomization\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\portal\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\common files\microsoft shared\smart tag\lists\Snood new version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\Battlefield 1942.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.clieCc:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\bloodRed.zip NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\NETSKY SOURCE CODE.zip .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\14.0.0.0__71e9bce111e9429c\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_msil\microsoft.sharepoint.businessdata.administration.client.intl\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.clie8c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\e2e42e6b0f65a618da8ab7235c27faf0\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\windows\assembly\gac_32\microsoft.sharepoint.businessdata.administration.client\14.0.0.0__71e9bce111e9429c\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3644 1920 WerFault.exe 27 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\3¨\wc:\program files (x86)\common files\microsoft shared\help\1028\Snood new version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\XÉTc:\program files àæ(c:\program files (x86)\common files\microsoft shared\themes14\quad\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ŽÚ° U[8à(c:\program files (x86)\common files\microsoft shared\vsta\8.0\x86\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\8c:\program files (x86)\common files\microsoft shared\web folders\1033\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\tÚ(c:\users\admin\appdata\roaming\macromedia\flash player\#sharedobjects\83wumn37\Tits.mpeg .scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\.lnkc:\users\all users\microsoft\windows\start menu\programs\sharepoint\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½uÜç(c:\program files (x86)\common files\microsoft shared\textconv\de-de\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\˜qTc:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\lv-lv\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\¸ÌKc:\program files àæ(c:\program files (x86)\common files\microsoft shared\help\1033\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files (x86)\common files\microsoft shared\ink\it-it\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\â(c:\program files (x86)\common files\microsoft shared\smart tag\lists\1033\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files (x86)\microsoft visual studio 8\common7\ide\vsta\itemtemplates\csharp\1033\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\ja-jp\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\ink\sk-sk\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files (x86)\common files\microsoft shared\ink\1.7\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files (x86)\common files\microsoft shared\themes14\papyrus\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files (x86)\common files\microsoft shared\translat\fren\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\comàæ(c:\program files\common files\microsoft shared\ink\nb-no\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\zh-cn\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files (x86)\common files\microsoft shared\equation\Battlefield 1942.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\program files (x86)\common files\microsoft shared\office14\office setup controller\office.en-us\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files\common files\microsoft shared\ink\th-th\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ô Pc:\program files\dvd maker\shared\dvdstyles\huecycle\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\dvd maker\shared\dvdstyles\videowall\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\°ÕPc:\program files (x86)\common files\microsoft shared\smart tag\lists\1033\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\XÉTc:\program files àæ(c:\program files (x86)\common files\microsoft shared\themes14\bluecalm\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÐòKc:\program files (x86)\windows media player\network sharing\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½uÜç(c:\program files\common files\microsoft shared\ink\zh-tw\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½uÜç(c:\program files (x86)\common files\microsoft shared\themes14\sonora\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½uÜç(c:\program files\common files\microsoft shared\vsto\10.0\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files (x86)\common files\microsoft shared\msinfo\es-es\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\xe\Hot Teen Porn.mpeg .exe\Britney spearuËu}r¯“8æ(c:\program files (x86)\common files\microsoft shared\msinfo\it-it\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\extconvc:\program files (x86)\common files\microsoft shared\textconvc:\program filesuËu}r¯“8æ(c:\program files (x86)\common files\microsoft shared\themes14\eclipse\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files (x86)\common files\microsoft shared\translat\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\&á[w ×(c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.csharp\7f0531cbaadefd63fb9c1f7ae51fc668\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\¬ÇLc:\program files\common files\microsoft shared\textconv\en-us\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\xá(c:\program files\common files\microsoft shared\vsto\10.0\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files (x86)\common files\microsoft shared\themes14\profile\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files (x86)\common files\microsoft shared\triedit\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\&á[wÔ(c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÿÿÿÿc:\program files\common files\microsoft shared\msinfo\en-us\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dvd maker\shared\dvdstyles\shatter\WinAmp 5 Crack.exec:\program fiuËu}r¯“8æ(c:\program files\dvd maker\shared\dvdstyles\vignette\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files (x86)\common files\microsoft shared\ink\en-us\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files (x86)\common files\microsoft shared\translat\frar\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ŽÚ€#;ŽÚc:\program files (x86)\common files\microsoft shared\web server extensions\14\bin\1033\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ŽÚP[ÍZXå(c:\program files (x86)\common files\microsoft shared\dw\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\spears naked Playboy.jpeg .pifc:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.csharp\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÚÀþoÁÚc:\program files\common files\microsoft shared\triedit\fr-fr\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\´ä(c:\program files (x86)\common files\microsoft shared\euro\Tits.mpeg .scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½uÜç(c:\program files (x86)\common files\microsoft shared\ink\fr-fr\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\_db\Hot Teen Porn.mpeg .exec:\users\admin\appdata\local\google\chrome\user data\desktopsharinghub\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ÚÀ;‰Úc:\program files\common files\microsoft shared\textconv\es-es\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½ulê(c:\program files (x86)\common files\microsoft shared\filters\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\TÊKc:\program files (x86)\common files\microsoft shared\filters\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\åO½uLå(c:\program files (x86)\common files\microsoft shared\office14\office setup controller\office64.en-us\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files (x86)\common files\microsoft shared\web server extensions\14\bin\1033\Visual Studio.NET.FULL.rar .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\3¨\wc:\users\admin\appdata\local\google\chrome\user data\default\shared_proto_db\metadata\Snood new version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dvd maker\shared\dvdstyles\oldage\WinAmp 5 Crack.exec:\program files\dvd maker\shared\dvdstyles\performance\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ØžPc:\program files\àæ(c:\program files\dvd maker\shared\dvdstyles\sports\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\â(c:\program files (x86)\common files\microsoft shared\office14\office setup controller\word.en-us\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\hwrcustomization\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\&á[w ×(c:\program files (x86)\common files\microsoft shared\equation\1033\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ìä(c:\program files (x86)\common files\microsoft shared\textconv\es-es\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3644 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 30 PID 1920 wrote to memory of 3644 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 30 PID 1920 wrote to memory of 3644 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 30 PID 1920 wrote to memory of 3644 1920 NEAS.10b81265235cb48dbabf45d482c52630.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.10b81265235cb48dbabf45d482c52630.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.10b81265235cb48dbabf45d482c52630.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 75882⤵
- Program crash
PID:3644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.0MB
MD56eff66788320ad752dfda2b30aef041c
SHA1308f9aed69e7786c4553a983e7e8d0874a38e92d
SHA256a1d560d99241dd7e148207bb08fcef6111e9fb120d25987020aa2ca0aa6c6514
SHA51269e4cee488214389bc428305f87397ecfffcc17a0a4159e71dd0783295bb3871849a1bfbf695e526319bac8796d5d42e2fb4dc40c30887c22ad80bb6f9dd967c