8fe7bb5fcf36bdf61354761ef3cea034fcf09db98ff05661e4a85185135e49b1

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
Size

54KB
MD5

5cda1d6c7d0c919295b5728b299687a0
SHA1

4cbb7759d8f679a6f12c634bd8d93293753025cd
SHA256

8fe7bb5fcf36bdf61354761ef3cea034fcf09db98ff05661e4a85185135e49b1
SHA512

fb81e520e596fc2092502ff74d6fd17dd6130c29515895d72676b165a79aa1417c2b2ff189e47d16d48442f7f500b2485af424baffdbff7f7f0fdf3fd7fe764b
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFjms:67Zf/FAxTWY1++PJHJXA/OsIZFms

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3737) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c0000000141c0-2.dat	upx
behavioral1/files/0x001c000000010439-6.dat	upx
behavioral1/memory/2360-650-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Journal\Templates\Music.jtp.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\RegisterStep.nfo.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Johannesburg.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\WatchExit.mp4.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	5cda1d6c7d0c919295b5728b299687a0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\5cda1d6c7d0c919295b5728b299687a0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\5cda1d6c7d0c919295b5728b299687a0_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
54KB

MD5
1fee35a52c75d377c6021ec7b26aab7d

SHA1
b748ca01e1cd342a24e86d92e8094e29ede9956a

SHA256
90025a3028e5a72861fa44306061662c732ef0dc1a131c428a99b293131fa547

SHA512
14112bdd599bc135d81ea630c8f8cf525587ac489931a043b797ef08b517e2b582b023e17e2a923100e164508dcd536a09bd42b523b5e32323c3b01048870e4a

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
af8ffb72366649719ce2e7c5908961fc

SHA1
dc0ad87674fa88c944a1a5b9945cf4c9538fd74a

SHA256
d8c83c8a6b64eabd4430875f5e32d6a12003d401906f7ea266a3dfea89943952

SHA512
cc0e7cd50914b324108ae8bf100c6de71fd01fa8b2f1ea65972f58c5656c0899b8eb4e7b178a1d184edf68d8cde80583bc3891a5a112ae34beab107bb6003015

Download Submit
memory/2360-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2360-650-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads