Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08-05-2024 16:33
Static task
static1
Behavioral task
behavioral1
Sample
be32debd30433276fba3d0b416c7e529_NEAS.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
be32debd30433276fba3d0b416c7e529_NEAS.exe
Resource
win10v2004-20240426-en
General
-
Target
be32debd30433276fba3d0b416c7e529_NEAS.exe
-
Size
104KB
-
MD5
be32debd30433276fba3d0b416c7e529
-
SHA1
1fac049b66bf2fb0c13ead2401fa65a0c23d5d97
-
SHA256
f379ef78de9619c7559ecf24d858e339ce448eaffe9735cf32808b2ef504ad6b
-
SHA512
960437cc421fb4586bbf0aff5d9095ec893ebedd2ddb6f7d95f05eddcd95e4cda834dad2cfd2b9d9c295e1571223b82dd74d045c23865762786bc7bb94803093
-
SSDEEP
768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5pYJIJDYJIJOO6O2lpHiJOP25LqrH5HiJOs:W7ZQpApjIWe+eoO6O2lpiMZiMjju
Malware Config
Signatures
-
Renames multiple (5004) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-oob.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TAG.XSL.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\D3DCompiler_47_cor3.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jre-1.8\lib\hijrah-config-umalqura.properties.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\dotnet.exe.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp be32debd30433276fba3d0b416c7e529_NEAS.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD54ebdaa92cca12cb2d2c827953219129a
SHA12772cefc4beae3605be6b62474138c2618496ae3
SHA256f0196c3f7ae94591615da0b68883678d568fdb8bcd915cb15de69b2cd8190504
SHA51253ee1960291daddea0b925b0dc25dc7d0b7097a80a17f7830a07a021a76208460d1a70e57358896a953217d6ab248b8f244c122bcda00487ba76d86d979088c9
-
Filesize
203KB
MD5a50e11c4796b5ae4cc8be9b93b65830c
SHA16fae656a986735897bb5ef0fbb3fb45b87d2ff3e
SHA256959f6bd7abe2da0c3708425f28072c9a1c063c2d557c392b55c2166f91fd6351
SHA512ae484a96497c018b4cda41e98d1e4be304925c8e6a6547d8f2b5b7b5b0ee83416957d7946e96030cefffdad6b1d6a140c223312c361648a18c8c5c4b8dabc623