Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 07:34

General

  • Target

    92c778405f1080a6623ae01149459830_NEAS.exe

  • Size

    224KB

  • MD5

    92c778405f1080a6623ae01149459830

  • SHA1

    9121dbfa20cd86366b2545e729e5c19d98905a54

  • SHA256

    806696b58a8068a8b1395fcb91f944823fe7af19e0347ce3a1faf5ab4ff88094

  • SHA512

    c4c807ed2058609108afeb018976973ff2f85ee57577dcf02f61aa77279c9333cd014fdff58faa717fcbdb01e27168cda846aae085efb5e39d95ac14dffd6739

  • SSDEEP

    6144:JmCAIuZAIuDMVtM/SgLzdGn6K85m9OA+tSo5VVR4:7AIuZAIuO98VVG

Score
9/10

Malware Config

Signatures

  • Renames multiple (4664) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92c778405f1080a6623ae01149459830_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\92c778405f1080a6623ae01149459830_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-17203666-93769886-2545153620-1000\desktop.ini.tmp

    Filesize

    224KB

    MD5

    5914f59dea0ea4e13f4bc2815d7cd2b8

    SHA1

    dbcdfded1a1e2522016a4666992e5785c966e592

    SHA256

    038bb0a801758a04b6282f9a347eff589ad7b235ab1d99e7c46774ab5c1712b1

    SHA512

    9b532236880b5e9fcf39d2ff05813a43def1c562c4eec798c4e426c5976418ba3847b77204a345ff4f64a2506a14def969722fd7ade214624de317f6d9136fc4

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    323KB

    MD5

    eacea55d6f9fb8f3e8cd51d573a56787

    SHA1

    2b42f571ebf6a98c9f5a887c76cdbeba17dc637b

    SHA256

    ecdd224f9cefa65196f0727191bf341c3e6b1ac806ccb1663b51a422cddac3c5

    SHA512

    4accb64662cd4e42893bc17b64fd0a8a0bd56a6d17f9712330406d9b36939e45328389a5dc81d3d26d67c93cca975fa146f68f0a2bc66249f97d755ce3e73c4c

  • memory/592-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/592-1520-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB