6326fa960596a9c16330cbcb4b3022aa9a3db878d87742b677bf30976400f691

Analysis

max time kernel
151s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34822e4c620689c18be81f4eae9341c0_NEAS.exe
Size

78KB
MD5

34822e4c620689c18be81f4eae9341c0
SHA1

a418b5904f82d1b1189330e14f1c1ce28ec3f4fe
SHA256

6326fa960596a9c16330cbcb4b3022aa9a3db878d87742b677bf30976400f691
SHA512

35189bf0d6ae4e494743450c4a22f645302d69727b60f2cc66c52031639fc2efaf3983f3e2c5c098333b1f32c1abd4e392bce26b7a942aa87d78571ade4ffb78
SSDEEP

1536:W7ZDpApYbWjIlE77ufL2e+e16alKlJOblJOb:6DWpwE7oL2e+e/lu

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlSerializer.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.IsolatedStorage.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Text.Encoding.CodePages.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.Design.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\System.Windows.Forms.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Xaml.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\WindowsBase.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Drawing.Primitives.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.InteropServices.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Pipes.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\WindowsBase.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationFramework.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemData.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\CloseGroup.M2V.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\UIAutomationProvider.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-handle-l1-1-0.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Xaml.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationTypes.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\WindowsFormsIntegration.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\PresentationUI.resources.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationCore.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\cursors.properties.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-conio-l1-1-0.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.AccessControl.dll.tmp	34822e4c620689c18be81f4eae9341c0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\34822e4c620689c18be81f4eae9341c0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\34822e4c620689c18be81f4eae9341c0_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
79KB

MD5
efd14f2cf0ae1c43b829bb623ca9093b

SHA1
375341009d1e589907af582974afbb574c46b210

SHA256
d0333299bcad743fd41673a346d4da7a5cebb38da011d3a22ab1df06bf525232

SHA512
3ba0cbf1be78628dea338c897f56cd200c76a2a141f8bd7916084c32a005b53edd96d5c164b8f36bb81ac4366afa569ac938ac4e545370e225b71c444f7191a0

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
78KB

MD5
9b43c2fa0444a16333fece9d738c6371

SHA1
728e2f2cf80a9038d55649359c90ac43abd64174

SHA256
b013b2bf1ce150381015aadfa1f9d0f181bafa300d17585b22724d7b503c8ee2

SHA512
423a594baca23b9925cf8ccff4b1041c08c1493d130024b7f841a8efa144f0c7d4eafb60cb17840be5c7bbb722966eee77618a1f0d8e97af68459649d0ab2193

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads