Analysis
-
max time kernel
147s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 09:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe
-
Size
443KB
-
MD5
30ab33f7ca7d85dabd71269dca9982d0
-
SHA1
dd546b1aaf9a3af6d7ea351a87b7db7acff481ca
-
SHA256
52ddcf678075d66f2e0b87c6f04d45772e224718419844ae2fe985f068cd2cbb
-
SHA512
43a7d5f578278fc62c30d64f7e80b1efbcf4d071e14aa90c4f24798dae99774a3b3eae0404f2f4c86698cd8225b2a7b2f156fa497116c6c8a52933db52f17aef
-
SSDEEP
6144:VFQ4afbQz3TOe6my2PcOq6KpCHNNZKJcfh2mgdeKzC/leySe8AIqpoHbnDns1NDE:VW4m8ntrpg/VyV8hEoHbI3I
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ttdinject.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\autoconv.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\cacls.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\iscsicli.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\nslookup.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\CheckNetIsolation.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\colorcpl.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\hh.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\runas.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\dfrgui.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\MRINFO.EXE 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\regini.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\relog.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\sc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\shutdown.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\iexpress.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\instnm.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\msfeedssync.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\autoconv.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\mountvol.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\calc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\Dism.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\finger.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\fsquirt.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\dllhost.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\finger.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\nslookup.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\RMActivate.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\wusa.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\xcopy.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\cmd.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\convert.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\dpapimig.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\openfiles.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\where.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\winrshost.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\fsquirt.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\pcaui.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\raserver.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\typeperf.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\convert.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SysWOW64\InputSwitchToastHandler.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\ReAgentc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\SysWOW64\eventcreate.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\Windows Mail\wabmig.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4EF9C35E-DC0D-40E1-941D-AB9119298CDF}\chrome_installer.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\r\uwfmgr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winload.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\IcsEntitlementHost.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\pcalua.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\CloudExperienceHostBroker.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\winload.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\psr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\r\audiodg.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvax64.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\ApplySettingsTemplateCatalog.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\r\tcblaunch.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\r\ClipUp.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\SystemUWPLauncher.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVDllSurrogate.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\explorer.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\AtBroker.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\audiodg.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Speech\Common\sapisvr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.SyncController.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\winload.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\f\vmms.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\windeploy.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.1_none_8ba2233855fede6e\EDPCleanup.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\f\oobeldr.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\r\AssignedAccessLockApp.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVDllSurrogate.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAgentPolicyGenerator.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15805.0_none_d67d06ef0c4a2e1c\InstallUtil.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_aadf84cda75da02d\aspnet_regsql.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\ApplyTrustOffline.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\f\autofmt.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\AppResolverUX.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\ApplyTrustOffline.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\r\AccountsControlHost.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1_none_bf56a5e7532d9c79\licensingdiag.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVDllSurrogate.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4340 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe 4340 30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\30ab33f7ca7d85dabd71269dca9982d0_NEAS.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4340