386d1e7455bd717f27c039f6b5de818f50345461ebc9f97bdb424789389c3bcb

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
Size

126KB
MD5

abd73b4262dedf9eb259cb75a9a063f0
SHA1

e68fac3a6ff5537f9491a15809fcc0bfb5d8d011
SHA256

386d1e7455bd717f27c039f6b5de818f50345461ebc9f97bdb424789389c3bcb
SHA512

9a02b085f17f745ab5e9365a8ebd42b5391e088553c4e95cca98ab40fa165942f170f505f1fd3df5aa0b428a1291896b72954940137e06478b7f669ae77da104
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCN:+nymCAIuZAIuYSMjoqtMHfhfI

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (450) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d000000014909-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/1664-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\jsprofilerui.dll.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\GroupStop.vdw.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_SelectionSubpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\abd73b4262dedf9eb259cb75a9a063f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
126KB

MD5
07d0653c61dc12cf01154460edb4232b

SHA1
3885232febb225f17cd5042436b26366e5209b56

SHA256
675180b34dff0c291a03231a5a98ff64441f5105fce7b290343491ea7cc1be33

SHA512
7189d4524efcf84d857cde7d34988efd512069c937b5d5036148a188c565a7538067e6304eea4c2eaf248136ae14e1481312b055c2d038dbe39a67092f5dba0d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
135KB

MD5
3a7798bceaf37d35cf3a50b3d1c5af61

SHA1
bf00d263b6ba9a1bb04b0f718a8472b57e0451bb

SHA256
b5e9803a51b48f4513b6943ef38692820c4605faba1a7152e2d4f11e07fcd9db

SHA512
cf211c7d75b66651100d282391796e46e7c523d0c23ba4197e622477fa7a4a8c915c6d80be67f12b4339157184fa4a0cde65b4e7bea8d356accf5c8f6282816f

Download Submit
memory/1664-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1664-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads