341756121865d9c667b10343306212733e84c88441038d607fac21053da1d36e

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f870ad7a9568b721e291e103493d20_NEAS.exe
Size

72KB
MD5

74f870ad7a9568b721e291e103493d20
SHA1

e33925028a3dd89017a63cd4f2ca4b48b64c89fb
SHA256

341756121865d9c667b10343306212733e84c88441038d607fac21053da1d36e
SHA512

0f0d88cbab29d89c62d770e0cded9de93d31fa918ab7f4bce91e4bc6758744d98908e7732f9a1867837583f12bb40226c44a18651f4bb2caa9188cad0744bb79
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVvhVeVg0fS:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcX

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3696) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DisableGrant.sql.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.THD.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mauritius.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\UninstallComplete.doc.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\leftnav.gif.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-execution.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libaudiobargraph_v_plugin.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvpx_plugin.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yekaterinburg.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cuiaba.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\74f870ad7a9568b721e291e103493d20_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\74f870ad7a9568b721e291e103493d20_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:2028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
72KB

MD5
a1f8cecf80681260583edbc76fa31941

SHA1
d9bcaafbd7ed5cb949ed4232d950e19bc92cb080

SHA256
14220b6370b416e0c40c0252d810a8c93c7587716cc2ebc94f98df98d5d439e1

SHA512
86af1c5c811ce9d76071a0967ed441090252c50361f8938b19f3f08338332cf70896cc5c97eaba08ebbade6723a426b29693479bf460a8608834bd5628415e5e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
dc00e69d69ebc70d339e4eaf9a75cc85

SHA1
989ae7c4421f7a7801a7c0420194dc9dd903aec0

SHA256
9ef5b0ea4314a4283fde6faf50b1739588a4ce34ce75728b53a83e309426d62d

SHA512
45f6bb2940fabea73c06ad6c5e94c7893ab4f87a57ef8c1c1e55dcf3be1bb5108abeb17323cb2cd4b091de1938afc5f22495541c8e99023cb8640ef8b5d109ac

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads