Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
16/11/2023, 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.10b81265235cb48dbabf45d482c52630.exe
Resource
win7-20231020-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.10b81265235cb48dbabf45d482c52630.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
NEAS.10b81265235cb48dbabf45d482c52630.exe
-
Size
8.0MB
-
MD5
10b81265235cb48dbabf45d482c52630
-
SHA1
fd406b2bff9ac4abd36e1ba6ee366cf4575ee068
-
SHA256
999b9b70d5078d72d6b018824ad58e53dd6703c1bd9fa9bc0a6ec46724450161
-
SHA512
1d004444819bef2584d16c3bd1841cf4c86085c7e4649932cd5b4087f13725c7e9dd432fbc1b1419b2ece0515254a742b55957cf6c549f170002ec16531dcb69
-
SSDEEP
196608:NoMl8D1jXgPo2S9+ULdNPtbuPZOOmnqogHh/p3k:kmw2SlLdNPt6ROOmqZn3k
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS NEAS.10b81265235cb48dbabf45d482c52630.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\32-bit Thunking service = "C:\\Windows\\system32\\thunk32.exe" NEAS.10b81265235cb48dbabf45d482c52630.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\SysHeal.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Windows\SysWOW64\SysHeal.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\zip64.sys NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\exe64.sys NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\detroit.txt NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Windows\SysWOW64\thunk32.exe NEAS.10b81265235cb48dbabf45d482c52630.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\he-il\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\hwrcustomization\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\cartridges\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\capsules\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\th-th\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\de-de\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\en-gb\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\tr-tr\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\euro\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\filters\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\platformcapabilities\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\1033\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\WinAmp 5 Crack.exec:\program files\common files\microsoft shared\ink\ja-jp\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\enes\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\windows media player\network sharing\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\ko-kr\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\vgx\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\1033\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\proof\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\source engine\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\vc\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\concrete\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\source engine\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\vsto\Norton AntiVirus 2006 BETA.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\profile\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\portal\1033\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\sl-si\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\triedit\en-us\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\cs-cz\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\boldstri\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\water\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\ar-ae\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\fr-fr\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\NETSKY SOURCE CODE.zip .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\pt-br\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fi-fi\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\textconv\en-us\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\et-ee\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\canyon\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\nl-nl\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\en-gb\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\fi-fi\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\grphflt\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\radial\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx64\microsoft sql server\130\shared\Norton AntiVirus 2006 BETA.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\1033\Britney spears naked Playboy.jpeg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\cultures\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\Nero ACID new cd burning and p2p.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\bloodRed.zip NEAS.10b81265235cb48dbabf45d482c52630.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1184 4064 WerFault.exe 83 -
NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\portal\Young teen gets reamed.mpg .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\jenna jameson screensaver.scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ler\office.en-us\WinAmp 5 Crack.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\(¼c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\source engine\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\°q”c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft sharedÇI”-ËM”-hÞdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\enfr\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\$ßdc:\program files\windows media player\network sharing\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ø{”c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ãC”-àÒdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\fr-ma\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u¼çdc:\program files\common files\microsoft shared\ink\en-gb\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\€³c:\program files\common files\microsoft shared\ink\ja-jp\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u¼çdc:\program files\common files\microsoft shared\ink\nl-nl\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\`à”c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\vba\vba7.1\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\º‘c:\program files\common files\microsoft shared\ink\th-th\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u àdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\1033\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u àdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\ice\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\Pè”c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\1033\Tits.mpeg .scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ãC”-àÒdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\ru-ru\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\sk-sk\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\in·q”-»u”-ædc:\program files\common files\microsoft shared\ink\sr-latn-rs\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\lists\1033\Hot Teen Porn.mpeg .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ãC”-àÒdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\ca-es\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\1033\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\Battlefield 1942.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\8Ðdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Norton AntiVirus 2006 BETA.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ages\themes\dark\Internet Explorer 7.exec:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\Tits.mpeg .scr NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u¼çdc:\program files\common files\microsoft shared\ink\pl-pl\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\°q”c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft sharedÇI”-ËM”-hÞdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\capsules\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\³N”-°ßdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\evrgreen\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\n.mpeg .exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\vba\vba7.1\DVD Copier.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u<Ódc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\hu-hu\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\³N”-°ßdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\breeze\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\n\1033\Battlefield 1942.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\es-mx\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u,ådc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u¼çdc:\program files\common files\microsoft shared\ink\lv-lv\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\in·q”-»u”-ædc:\program files\common files\microsoft shared\ink\pl-pl\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u<Ódc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\sk-sk\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\“q”-Ðädc:\program files\common files\microsoft shared\ink\fsdefinitions\main\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\°q”c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft sharedÇI”-ËM”-hÞdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\refined\WinAmp 5 Crack.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\$×dc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\Ä×dc:\program files\windowsapps\microsoft.windowsmaps_5.1906.1972.0_x64__8wekyb3d8bbwe\assets\images\printandshare\Hot Teen Porn.mpeg .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u àdc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\86\microsoft shared\vba\vba7.1\Battlefield 1942.exec:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ons\Young teen gets reamed.mpg .pifc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\tÏdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\en-il\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\2.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\Kazaa Lite 2005 Edition.zip .pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\³N”-°ßdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\arctic\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ ×”c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\bluecalm\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u àdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\sonora\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ãC”-àÒdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\pl-pl\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\lt-lt\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\¨¿c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ack.exec:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\~]Õ‚ì_£I¹wΡœ† #Åt ÑÁtœÜdc:\program files\common files\microsoft shared\clicktorun\Windows XP crack.zip .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\€¶c:\program files\common files\microsoft shared\ink\es-mx\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].uœâdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\help\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\³N”-°ßdc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\1033\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\3c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\1033\Internet Explorer 7.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\cw”-`çdc:\program files\common files\microsoft shared\ink\nb-no\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\h¼c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\en-us\Windows Longhorn BETA.iso .exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\,].u àdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\ricepapr\Adobe Photoshop 6 Full Version.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\DÜdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\sonora\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\cw”-`çdc:\program files\common files\microsoft shared\ink\pt-br\WinRAR.exe NEAS.10b81265235cb48dbabf45d482c52630.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\msinfo\it-it\Windows XP Pro SP2.pif NEAS.10b81265235cb48dbabf45d482c52630.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe 4064 NEAS.10b81265235cb48dbabf45d482c52630.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.10b81265235cb48dbabf45d482c52630.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.10b81265235cb48dbabf45d482c52630.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 36722⤵
- Program crash
PID:1184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4064 -ip 40641⤵PID:3504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.5MB
MD55f64d8adcfb47f3a35a1e39b98921aea
SHA1fa34055c0ad014a7100222d74a204ffbfed375f1
SHA256c668ebe2cda27b90ebb998abc776bd8ae576d7cbbf816df7cdd86c408e3ea33a
SHA512f414c5df847c2927147cd83c8a311b5da71ad9b8adcbd70695a723142f02199407707cbe1d0665dfdc94c4fc5efbf330df316f74ebabfd79851d36b6394c8328