02a7d829804d36cd221935f4378b355be98664b237a3806a40a0e44b0a380d13

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
Size

130KB
MD5

91acd372c6c8186dd4610a0ce2b34ef4
SHA1

c66b3c16dc1fe1c5e2162c92bfd7cb1a02c04ed2
SHA256

02a7d829804d36cd221935f4378b355be98664b237a3806a40a0e44b0a380d13
SHA512

8651d75bac5239d5d3b7ecd5d2f2ab521bead07f396af2c6dc2fcbe4869348585f7a33be66fbd84a0189fc4e66d99eb7e25abb5a37188427f41fb2da5313b17b
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCE:+nymCAIuZAIuYSMjoqtMHfhf5SM

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4681) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1396-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000c000000023b4c-2.dat	upx
behavioral2/files/0x000b000000023ba7-6.dat	upx
behavioral2/memory/1396-1468-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Channels.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\README.html.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-pl.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PowerPointNaiveBayesCommandRanker.txt.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-100.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_it.properties.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.VisualC.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\WindowsBase.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\91acd372c6c8186dd4610a0ce2b34ef4_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
131KB

MD5
1d23fcf4600078d38ac2733fe463c177

SHA1
696f5f0ae5773a7261645a7967e43eb905b36fa0

SHA256
b5b48bf2add27f529092442791564a64d40b2992895cf483dccc53bc22afe50f

SHA512
02dffc99346316656741b3d7240705881bbf1625114a830c24f2b857aa340e71629174d756fa2e33525a2f9954970a8be53e6ded212f78b202803e87445190f9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
229KB

MD5
44f7cceae8cc2d2de2b10514b3730ba3

SHA1
2990a76d3a90411fd1382f59df9fd0ac09b56667

SHA256
e0210e8c600ce972503b0c0edc3eef3bf453353aae1c3e22ef73ac632994fd10

SHA512
fe262e796f30f02cbe66163b26fd0a3c77e9b387b3806d634bc8b0c64c71abff752259c479bc5fcc1ed940310cb20ac7bb38c6dfb658ba43954dc59d9411c2eb

Download Submit
memory/1396-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1396-1468-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads