45f37bdecfb9c5618662444eb53c59cbc3c37d62a15491d8832f4f1ec72bd589

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/05/2024, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
Size

64KB
MD5

362c4bdfae4f33679bcfcf27cbef8600
SHA1

c115398e7b39cd4329f2331a603c12c20f0cda67
SHA256

45f37bdecfb9c5618662444eb53c59cbc3c37d62a15491d8832f4f1ec72bd589
SHA512

2bf195a4f2e8d8c7040e142d177de6efcbd21e09b91850909471cd2570ff6b11e84bb104984a5fa89f1c9a35cda5db57b7949ff665a2615e8aee262b9fb4e906
SSDEEP

768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2Fnj28/8aFKtBYJIJDYJIJH:W7ZDpApYbWjCDOgj28/8HtOe+et

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3709) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs_5.5.0.165303.jar.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baku.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\cpu.js.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\gadget.xml.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.ServiceModel.Resources.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\service.js.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\highDpiImageSwap.js.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\tipresx.dll.mui.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\WaitGroup.lnk.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml.tmp	362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\362c4bdfae4f33679bcfcf27cbef8600_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
65KB

MD5
26b9d31b705cf6111035b475d6683667

SHA1
e34574ab82b5646254516017f123c9ce55328bd1

SHA256
b133105dbd4c8af34085a387e36f6a2092a4145bc487a8d379a739432814e3b9

SHA512
5c6388f3007c96f1e803a681bbb9b3e92932c55581eab91b2caa760868ab505771bc168f4f466a58bc194047cc53b79b23c000992e3fc546fe80358878cfa1fe

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
74KB

MD5
36dc5aedf93dfc7c919e78ae2a612f81

SHA1
f498e742203e457dbcd2386480c9c67bbe85423e

SHA256
26a7ef5e992d0e3da7cc70742b987173b22c8c413543f5f01602759d7f781767

SHA512
9a49a27a35934b739c242d5af780785c06482b23ca53b4e136aed3d3945d59a83b85e6d2ad6eb9b6920c6e2759928cce5b2feb8471cd508473fa13b53100622a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads