Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2024, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe
Resource
win10v2004-20240426-en
General
-
Target
2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe
-
Size
65KB
-
MD5
2fd0138130fbfec4b31332d08fc2d1f0
-
SHA1
745e30b471731337f41b203ad2463d59f9f979bd
-
SHA256
68fe083a2ce57bb3e39af3383ab0e8c04e786e7f32ef72e87451638ea7ecd5ef
-
SHA512
5e3e1cbdb2afdc4d593ccba1e9614475a075e4cc91f6af837add156df6cd18eca0ff379b4965ecb3416941c5fc57afa459b07d0fd7f74909e8facbaee6a42d3a
-
SSDEEP
768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2Fnj28/8UMWMtb9IWW0DiDyrJfs6fW:W7ZDpApYbWjCDOgj28/8vhtby
Malware Config
Signatures
-
Renames multiple (5177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\glass.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationCore.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\LoanAmortization.xltx.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\7-Zip\Lang\io.txt.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe File created C:\Program Files\7-Zip\Lang\kk.txt.tmp 2fd0138130fbfec4b31332d08fc2d1f0_NEAS.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD52aed98084bbe23e088657116d15c5be1
SHA165db16fa29f6c46ed2ee7fb95902465f58e2be3f
SHA2560dd1ffc70d4b0fc822ec78a571e2ce35b1fe9118dda70c5988433fa8c57ab57d
SHA51212c31f1391c96c4edaa5aece02586c9de726d397152f21eda21e36a9893a805701973d82f66e4f78ccc76f94b0c61a69f68a0c3564ec0947d3789e89436b7d74
-
Filesize
164KB
MD55bd83f70cc2140f17a506f26ef70ab3b
SHA12caf6ef338243c5a30a808ad080ecce34ce27a1f
SHA256fc9e62e19efcb028f7f6db0ded8699e5eb4c301733e1af271f7ce7976a50e5b4
SHA512b0f4c883427320662b80cc6f44a7cf7ec98729c2820248c777c0d9c67b96a89b1924cce778368328146474c8a4af0d7ede154444297279741de16a5dbb64a795