262afa8de6c5cfa7c3437971b7c649b54aa48ba86aeb6d55db28a4488a80cf8a

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/05/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0df48b4d53761431367ed6ac63a524c0_NEAS.exe
Size

85KB
MD5

0df48b4d53761431367ed6ac63a524c0
SHA1

e2f7212acdfa8189c0067a6f1dc2b7fa14a6b5e0
SHA256

262afa8de6c5cfa7c3437971b7c649b54aa48ba86aeb6d55db28a4488a80cf8a
SHA512

0ba0387a5b93f80267cff4aaec1c803dcf6b9bd692f30d7e8c27cd86509d479b75a8a2c72842c79e82d9a847a77f5ff94d3bdfc17613c01951ab9a0a6a30e4e0
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/M6F:6e7WpMaxeb0CYJ97lEYNR73e+eKZh

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3687) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\defaultagent.ini.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\BlockUnlock.htm.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\jfr.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Cordoba.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\bin\server\Xusage.txt.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Recife.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.resources.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libwave_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\UndoStep.mpeg.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libjpeg_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.continuation_8.1.14.v20131031.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_ja_4.4.0.v20140623020002.jar.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-string-l1-1-0.dll.tmp	0df48b4d53761431367ed6ac63a524c0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\0df48b4d53761431367ed6ac63a524c0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\0df48b4d53761431367ed6ac63a524c0_NEAS.exe"
1⤵
- Drops file in Program Files directory
PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
85KB

MD5
2e14cd325fec899904dcf7c0a9703a97

SHA1
dc0bd8d8b7ac31b56f41323b7e57d9c1784af544

SHA256
cf9e342e324a5c90aeac3913969bab1cc0a1302ce71230a8c3889cc98b16fb29

SHA512
a910db28ead2f5c3d3db2cf2759134b337bcbd6cda5fcbc1aedbd7eba82811000aeffc6af25a5426389d56dc94035dabaeba34b4de2900f73c87a0465da6ee5c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
94KB

MD5
df911ab3d6cfdf150d02af9f2f8804ec

SHA1
0f575103dc9140569e72a60f75f88a3e1af13a06

SHA256
a6034f808aa8df372e52d063754280e4bb1c6e299fc45ba84fdc10a1c8d74125

SHA512
3b4873836a0f2117411e636d716197e7c78bea0c27ec3fb7063612833d343ed655b0536e42ab2b37e803595af90300308816df24b5a7b575616d92f7759d2ff8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads