341756121865d9c667b10343306212733e84c88441038d607fac21053da1d36e

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74f870ad7a9568b721e291e103493d20_NEAS.exe
Size

72KB
MD5

74f870ad7a9568b721e291e103493d20
SHA1

e33925028a3dd89017a63cd4f2ca4b48b64c89fb
SHA256

341756121865d9c667b10343306212733e84c88441038d607fac21053da1d36e
SHA512

0f0d88cbab29d89c62d770e0cded9de93d31fa918ab7f4bce91e4bc6758744d98908e7732f9a1867837583f12bb40226c44a18651f4bb2caa9188cad0744bb79
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVvhVeVg0fS:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcX

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5035) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Writer.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mce.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\release.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc.tmp	74f870ad7a9568b721e291e103493d20_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	74f870ad7a9568b721e291e103493d20_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\74f870ad7a9568b721e291e103493d20_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\74f870ad7a9568b721e291e103493d20_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:3868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
72KB

MD5
fe8c9d5fab37678e1e00324f6d4668dc

SHA1
88450534a1070dde2a56b58329b4fd466bc7d6f4

SHA256
8fb8452e823762f34ed382bbbd7d8e8c4ddf8e81ffeb517cf483b4c8cdbf9faa

SHA512
8758bdc42cc8945bc5cfb60adcf90cbaef030116bb6f726e4af331acd5758629285411b7901ca61ed87261f6f23b1b5411ff229bb404877aaede8311ad6d22a1

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
171KB

MD5
90b7216e2a4b9a7a34f2f714d6e35f2e

SHA1
f592e58c2c723f174203c74df6fcaf0eacef4816

SHA256
831ed21ee2b91966ecd444b397cf8c47c25c7da48b554314ddc168d57fa996d6

SHA512
4fa7dbc665c495ea0766b2f9a9ac44be8d59725d004578d47fc477edc7c01ee2bbd7414af616dd5a59121364fac892942875d849adc46473c4daf6d90cc8fdff

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads