fdc5e269db6f8f709c4c2b1634a26e4bfe1717db24fdc6d4a52338afadf4b123

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27ff3b468f97a8e116b822635d731d12_NEAS.exe
Size

121KB
MD5

27ff3b468f97a8e116b822635d731d12
SHA1

65c8088c54b6749c4b5bc3c333a325bdc61a0e0a
SHA256

fdc5e269db6f8f709c4c2b1634a26e4bfe1717db24fdc6d4a52338afadf4b123
SHA512

54ceeb105d6bd21ad1f83c7fc106ee47cced3ee9cb481e0ac6f8d4bb9ef75d971dd5a2adbcf9cd4efa8922e7a913a7085ed9ad6aa6a75438c549ca23542b03f7
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfliB:hfAIuZAIuYSMjoqtMHfhflixisXxX9

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3427) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000012671-2.dat	upx
behavioral1/memory/1948-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/1948-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Istanbul.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Windows Journal\de-DE\MSPVWCTL.DLL.mui.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lord_Howe.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Nairobi.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.contexts_1.3.100.v20140407-1019.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\d3dcompiler_47.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Microsoft Office\Office14\Custom.propdesc.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\org.eclipse.rcp_root_4.4.0.v20141007-2301.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\npjp2.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationFramework.resources.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson_Creek.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssv.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kiritimati.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll.tmp	27ff3b468f97a8e116b822635d731d12_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\27ff3b468f97a8e116b822635d731d12_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\27ff3b468f97a8e116b822635d731d12_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
121KB

MD5
ccbdf67105f68f187bb159da6df1626b

SHA1
deb39743c462f622a543fa84b5a5e01f195b2d1a

SHA256
69cdab526383aeea19304b714f62825085dfff762343ca43707d4a35f0cf3184

SHA512
cea77e53d67e9f31c46bfb67cd4e432cda817b9acde162d635f2382c682c9be23b36a3d8dc4642080fae6c5fa0afa92bc3f0c1d621acd64d2ab5b4411347ce37

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
130KB

MD5
3eaa089ecec30371fed6e11956a8fce7

SHA1
a64a7f01e5436d71132ce6ae8dc192535ae9b05f

SHA256
4b228021b81594c3660e7f046c15c4f34bb93066d8ce665a0c6cbf7e392154d2

SHA512
0d284a47eaa0d9497eaa3ec4f8ec2a5d26efd977f5da1c47b3a057a663466023e92846236742c4db46e2feb611bd95a8711fb93fcf0b1f098a0f025333ab6521

Download Submit
memory/1948-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1948-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads