02a7d829804d36cd221935f4378b355be98664b237a3806a40a0e44b0a380d13

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
Size

130KB
MD5

91acd372c6c8186dd4610a0ce2b34ef4
SHA1

c66b3c16dc1fe1c5e2162c92bfd7cb1a02c04ed2
SHA256

02a7d829804d36cd221935f4378b355be98664b237a3806a40a0e44b0a380d13
SHA512

8651d75bac5239d5d3b7ecd5d2f2ab521bead07f396af2c6dc2fcbe4869348585f7a33be66fbd84a0189fc4e66d99eb7e25abb5a37188427f41fb2da5313b17b
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCE:+nymCAIuZAIuYSMjoqtMHfhf5SM

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1600-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d00000001228a-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/1600-394-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libdolby_surround_decoder_plugin.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\jp2native.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\pa-in.txt.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\PushDisconnect.easmx.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Hobart.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jvmstat.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\GoldRing.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-coredump.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
131KB

MD5
f2cf44529ae31e69001d5ddde9b98995

SHA1
b9d76cc19dcb7956f8e764c980a4e3158dc41713

SHA256
f73bdf7ba11105ddf3944676cc06789b60c1629cc52df7059788a66cf72a37d1

SHA512
acf75ddcd34ee31b2f2bd2a28db4ea8fd8770bcaf116de6e0644835b8aded9af0bcb42848443c5e87fec4cb05aaa1256ec066ab1870e365df33874d36d8d5d0d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
140KB

MD5
abee724aada427e0df765c2cb8091798

SHA1
d589b6d2e67d3898c8e2565404f448e1b26c0498

SHA256
d84341e7d0c4129c76c3da4e7a513141c33a1b2be88cf5d2cea1393e204ff9f0

SHA512
d18916f4f15e15247dba618c6ba421f0f8a7259a627d68cd799a67e0fe48da016fe23ee5f125c05a6c3522dd9fd4eb405bfc72c83dc5aadcef21e31c11177486

Download Submit
memory/1600-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1600-394-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads