9f9e216e87b6fed7dff18119dd7f58306f08d031e5301429f7e74f5d3730f29f

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
Size

159KB
MD5

dce40ac3b6582f52efe5a8a872bdc0d0
SHA1

3692df3b5e2bb97a0e781db0ff053ca0cd1c3b57
SHA256

9f9e216e87b6fed7dff18119dd7f58306f08d031e5301429f7e74f5d3730f29f
SHA512

d56baa07f4d65b89728d7ef1137b65043a5335ef4f3d31a343ccbcfdb1ab11238103f975735abfc59c6bc5a49e9ff4678e14240612bad2f3d483f5cf35b59d20
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJ4:KQSo1EZGtKgZGtK/PgtU1wAIuZAIuy

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (335) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1312-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d0000000122d1-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/1312-18-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\CircleSubpicture.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\button-highlight.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dce40ac3b6582f52efe5a8a872bdc0d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
159KB

MD5
80cf2fc1f795927d99bf4bded2007d3f

SHA1
6d58dc1363b691ff575d8f4af75fe16cfcc16aad

SHA256
27458383e46db5541dd0adecbe787acd3d9298b75e76adae9632a905d03d03df

SHA512
b83d0fdf6b96cfb4ccf3146528823079ff7fc5c1147f2d72eebde9982c49979c725b81ed3d8299c01e88a78deeb23292ae8f3c9e37320c3f37d67dd73817bf97

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
168KB

MD5
09efe854fa0a2cfc430d0a00ed9217bc

SHA1
7cb4fbd07ab825dfe8b26ad0c12254a7ecf5ab43

SHA256
df98e70da96cbe5fcdabeb6de427dadcde6122678f70891a23798cbcacf1cde8

SHA512
d26e61fed6efa74b6a0c63687c87b49a28048ccc9189061497e923f46d42efd707461b04d41ce0d183386ed73b936d33a674a88d5768265928f0570533e88a25

Download Submit
memory/1312-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1312-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads