09bb25c14abf6a91675e3ce2d21dd85249cc9e1014c3e305185b192dad1bbfd4

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
Size

74KB
MD5

15ed5d04f1bf160c2dd9fff29aac23f1
SHA1

3e02b253b722457e3e69b4de7d125f1985e7e9d0
SHA256

09bb25c14abf6a91675e3ce2d21dd85249cc9e1014c3e305185b192dad1bbfd4
SHA512

1825b7785021f41e8e97324d7ff315011e2042df42ac3f038d85d7ac4cee0cf2494776dfaf81cf6d35981a765c1f678ee67c544c40c9d4532f842ae6c99d7e5b
SSDEEP

768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJO:W7Z9pApQESOHepOHe8G+6E65TGAR9a

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4951) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.bfc.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Input.Manipulations.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationProvider.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsdt.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.DLL.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp	15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\15ed5d04f1bf160c2dd9fff29aac23f1_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:4848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
75KB

MD5
e6536d2ec119090e62699545159acab1

SHA1
20819e715d7b4abfb421a5abf5902f58ba3f2561

SHA256
3d9281a6ec982b476419ccb58770b3ea7b3690fb04b704384466af2068435697

SHA512
42fe48a5b89b3b75220134bca08678b04b0511835ba1864722c92c893f9b4b319cae95d8a359266dddd27d45aa366db132d6a26facd0ba4ee911f0804988d3a7

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
173KB

MD5
fa108fcbc1d68e5a1a62ec7786c4b5cd

SHA1
9326d8575b7d9f8e461ae254a34df43cd2605c85

SHA256
4ee431ad4d3a89b9c5ee095b22eddd286651bccc9d9cca21762ea3bd64a8df15

SHA512
511d7db284f72fef6cc08fc0fa53b6cf1f4cf0e50e2cd48eadbe60e21eff3158b4f081c04ca616b9cd87ecc3f8cd2c3eb14fd6c4cd3534a49657837039c6ded5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads