613026096ee507d13ba47ecb64f5ede49f1b85a190c2d9d0838df233f3817c45

Analysis

max time kernel
150s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
Size

177KB
MD5

edf9c39840cd372a1f95082139bf8dd0
SHA1

31daa858390c5e9c0f2e35b875d117ec00d0febe
SHA256

613026096ee507d13ba47ecb64f5ede49f1b85a190c2d9d0838df233f3817c45
SHA512

f1976f2dbecaf92e77a3d507ad7e55dccc249f0201279a14756dac7421fcae180e037c71ff28f8a7d6a195129eee9c3acd2c8669667a8e7c7b65c4da609818f4
SSDEEP

3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIu3:JiQSo1EZGtKgZGtK/CAIuZAIu3

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4796) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4008-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000235b7-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/4008-1728-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-pl.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\CIEXYZ.pf.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Resources.Reader.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ppd.xrm-ms.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\edf9c39840cd372a1f95082139bf8dd0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:8
1⤵
PID:2888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
177KB

MD5
55a97140ca750f19c19dbddf0e52ad66

SHA1
9b3deecd1581fb0e236e2beaf72ae6380b459c84

SHA256
e64af9e04e769506a2cb6d720fed94a1c18da0a5cc94c87aaff82f62ed7ee377

SHA512
c924dfb72efc8f6df222a6218ef244192fd8aca34b7e8e62e44133a4379de16901986ec47bff07534800e1e945ffa3ee4aa4bd08481007e467831fe7bee864fc

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
290KB

MD5
7dd27879e25ccd6ceee86afde49a81f3

SHA1
52ec2dd958268cf189a998896f5d71ddb2f4c788

SHA256
72677909face14c2200bbc4f8c3410e8a8561e681af8f9c92d62903b1bc676c1

SHA512
5f0a4ecd4c0b2c5da9e0de84574c214c1190948610700fdee78d7a126a3cb8d05b1ec6fdd78620404b20371a212b3d80f28fb9eb7c389766544557188dea43d6

Download Submit
memory/4008-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4008-1728-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads