996b116ac56b5c1906f7787fb5775165f81cdd08f2863c9e8df99e8b092c75dc

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
Size

335KB
MD5

5fbb49b161ec13a0794c11c3ab86f220
SHA1

34546128879ad9433b21a0fc9bf6e75344422a02
SHA256

996b116ac56b5c1906f7787fb5775165f81cdd08f2863c9e8df99e8b092c75dc
SHA512

87b29beff29ba4206a98612a0bee6ffe2381970b9ad0933bdd5a3dd876fd793b23c8a78ee940716e246b0d8b46b38aeda8c1fbdb1f7e9a0c760de673d6cdabcd
SSDEEP

6144:JiQSo1EZGtKgZGtK/CAIuZAIuzQSo1EZGtKgZGtK/CAIuZAIu2:AQtyZGtKgZGtK/CAIuZAIuzQtyZGtKg7

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2828) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1568-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000e000000012345-2.dat	upx
behavioral1/files/0x00030000000104b4-6.dat	upx
behavioral1/memory/1568-456-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\rmid.exe.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme_0.9.300.v20140424-2042.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Luis.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Microsoft Games\Solitaire\de-DE\Solitaire.exe.mui.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\background.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tokyo.tmp	5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\5fbb49b161ec13a0794c11c3ab86f220_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
335KB

MD5
a4cc83a92868c362fc687f8086be4ec5

SHA1
bba04af442091f76fea5d92e81e8dd42c7f4337d

SHA256
2bdbd4a28308f214666897aab5730306459d98782816dcf892c0f9c8ec30b9da

SHA512
772018c39cb0c3034a6567de3a928a9653331da7bea8588ecd193cc83dd54f22253ac483a23e852ee74b85dbe05787724f2b8f99fd0161431d113f855cf9983b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
344KB

MD5
014d57c36ebb7307e7c8f468005f659b

SHA1
bb80aa415166b497fe9343c6a252bba23cf65ed0

SHA256
27a461744d1c2aa52388831c64e35b03d509c46b64a788b42c89377bc9282ef7

SHA512
59ead58323bb8587f1987ce848f4b962ded98735c7dae4eb8d392010dcf3cccc12e48649f83d571741a5139166f99bcc4ee0b6211acd4e57a98cbe7e214af8a8

Download Submit
memory/1568-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1568-456-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads