812c0acd32b95ad785e026c8a00b2fba2161e22f3142c1cd5467d6f0251b1d36

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
Size

141KB
MD5

4a3d518b459c87616d97b0d7e7f8bf70
SHA1

4c676bf520b398f8ccf67cc0ce64a6bf15188e77
SHA256

812c0acd32b95ad785e026c8a00b2fba2161e22f3142c1cd5467d6f0251b1d36
SHA512

fd6a990e178b10c01288b060762942bdbe246d9ebc207e6076166eeed99472fc2cc05ad8a88b9fdec38f197d8bf6e3905de43969e9ffde28bfffd7c97bb66162
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCC:+nymCAIuZAIuYSMjoqtMHfhflixiz

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3427) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1996-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d000000014708-2.dat	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/1996-616-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libfile_keystore_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liboldmovie_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_ja.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vilnius.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.servlet_8.1.14.v20131031.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipTsf.dll.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_zh_4.4.0.v20140623020002.jar.tmp	4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\4a3d518b459c87616d97b0d7e7f8bf70_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
142KB

MD5
5c7426a64dc3967363c7cb11791255df

SHA1
f6adaf81575b8a88d400f3d0cde41a52caef1671

SHA256
3610165d439659bdd2164339423219022b66aaa3c50dab9f719366e2c2524913

SHA512
8c82ad1295af76387a2901dffee08848e394b935369a89d79f21dd3ae3bae8082f6f7051bc08dc8bc7b1112809c6244bbcf7d9dcc489d4af04ad239ce9454ee5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
151KB

MD5
6e6e8eff244c18f8c03fcb490014c510

SHA1
72e17979a01d658c28755fa8286e672a06a5327c

SHA256
07ba99774a9c7a72bd467a86dce404d0f2ef8aee61462b784cafbc3fbc99ffdb

SHA512
8adf9034aaaba51f462aa500139444a433d4493e7d94f467eb5fc523b1eda1ec26bfe26291e543d8ba26f8778fe33522195d55fb4c669fdb83bc4960cb877938

Download Submit
memory/1996-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1996-616-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads