b0212854b05570080aaecd1886b72973100525548d13c6f5882366e59f99a31b

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69663351d14b322adfd51741320d92d0_NEAS.exe
Size

86KB
MD5

69663351d14b322adfd51741320d92d0
SHA1

7baa91875383aa953293c788e8ed6c17d783a8f2
SHA256

b0212854b05570080aaecd1886b72973100525548d13c6f5882366e59f99a31b
SHA512

75a87dfafe3c155b2ff7b83d290228e02e702b25aab50a6a61ba26b846488bae59737fd79e054c60dc7d16e65f4389de42f14425189cc67056e492c0aaf95c09
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN+:6rWpcOPxPke+e3fFpsJOfFpsJbgEE

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\de-DE\WMPDMC.exe.mui.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Gibraltar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\settings.css.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtwolame_plugin.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp	69663351d14b322adfd51741320d92d0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\69663351d14b322adfd51741320d92d0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\69663351d14b322adfd51741320d92d0_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:2188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
86KB

MD5
c6a8523ac348337d01b286a3f2285a31

SHA1
8ec16a9c32f6cd571a5272b9937fe8a62fb2a500

SHA256
d1c990f1486f1eeb8f9bc269919fd6f4ef2d7929ef5dd31a10820c0531daa75a

SHA512
6b2aa2cd8bef862c61e58a5c70dedfd0615688344215dc64f40b32a99d405a6717f5c3c338df67106eb1fa6694881c507c3542f17e113388716c4a27736cfdba

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
95KB

MD5
2ba02e798080ca0f5d4f340fb19cb58f

SHA1
7938ca32deaa68911d2516cb65ab6381757d0a57

SHA256
cd4498459488ecf5ce5836b341ae7f58724965e52b09fa992f0ecb0ed6e535ed

SHA512
8153e19f2c773fa7773cbdc274e1080ed3ca523acc9c777f15ba22329679222a4480387f5a2f7658ecc62440e5adbbb14671e0298c30ee9fff2015064daf9df2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads