Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
aef8414f1422fa21b0209def99e5db66_NEAS.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aef8414f1422fa21b0209def99e5db66_NEAS.exe
Resource
win10v2004-20240419-en
General
-
Target
aef8414f1422fa21b0209def99e5db66_NEAS.exe
-
Size
378KB
-
MD5
aef8414f1422fa21b0209def99e5db66
-
SHA1
23a61b0ebdbf9492523879e09d5f894ac34e92d9
-
SHA256
2d73a1fa8b61c47e53cf471899bdcf7399f062a8c050aa25af2c04a886d58088
-
SHA512
6c930c97215a39eb774cf616e61b07f260706ccf30ed7cfb0fcc84304b62b276f1b8d56389ff81fb5cc097d59591652cb8d35ee831c00f2c3ea53f9a0d43ba53
-
SSDEEP
6144:tFPxPke+eIr9RUxfKIuqBcKxNWdp+bkrdHs1lpaSL4vtFVHPyvewDpgs5hBhv:3PxPir9RyiIuGcKbpaSL4vtFVHPyvewf
Malware Config
Signatures
-
Renames multiple (4191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zCon.sfx.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\lt.pak.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ppd.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONINTL.DLL.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pcsc.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-1-0.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ul-oob.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationUI.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.ProgressiveProcessing.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ta.pak.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\decora_sse.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-pl.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp aef8414f1422fa21b0209def99e5db66_NEAS.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD5138359e77391bd4d6a9b2725f173c4dc
SHA1cb9fe6e336ad006a5b905e9a8b16880d45b5ebcc
SHA256b9127b5284efc855b680915771fd5b47b2c2d1b40bc6b9737ad5db91ddb6a5f8
SHA512881b811cf8aaac6de3ef7abdcc0f0d3a3843207874bf321b2fd605f6d600ee70b99c515ee78d1767dd319a039dde5901fd83b4cb370f7780d93299e66b42ce71
-
Filesize
477KB
MD5dabec85162f316630864d30d0aebf777
SHA1f873713da36073ced7a6722606a7fadffe2a875a
SHA25699ee47b55d35621383354d60cefbb4f30b6ab99b569b057934a0a623c16b4dc8
SHA5120f38428e5e9b7bbaf07a153a988aa1b95e8001d770da720a6f9ff518b983b5301a7e26b75a6bbfe96331ed08817f7523950f2438bbb39ddd1e87bee9f34b4a54