1b133bdbd1d39c9bc42e3eb1432a0ddd2a163c1e0c250c86fe9210d3e12cb142

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
Size

147KB
MD5

06244f224d7d380167736f3d52a65d40
SHA1

ab36b9226fe7855552b31ab929549af949be5f59
SHA256

1b133bdbd1d39c9bc42e3eb1432a0ddd2a163c1e0c250c86fe9210d3e12cb142
SHA512

1ca06b12058045260bcf4b275abc419e951c2bb5a6b873cb16371eb65315b59fa545528e692230150c76e877ccd1d3d1cc7deebdadf75481303d26d55e1f2ffc
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q1pkMJ+ZGtK1+ZGtKQNMdTajOtGtU1wAIuZAIuJp:KQSo1EZGtKgZGtK/PgtU1wAIuZAIu/

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3438) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2368-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000013a3f-2.dat	upx
behavioral1/files/0x0002000000010679-6.dat	upx
behavioral1/memory/2368-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Speech.resources.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\MSOERES.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\net.properties.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench_1.2.1.v20140901-1244.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Saipan.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\java.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPSideShowGadget.exe.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Palmer.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jsse.jar.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\EET.tmp	06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06244f224d7d380167736f3d52a65d40_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
148KB

MD5
b6c375d0df10df7a7f0542e5ccc262e6

SHA1
52b2f86b7ffe0dd38892a6a1ccdc5afa77e2aecf

SHA256
0c6f73944d2d1ab092ffacb892b13a5f0f55715f0db51048b076c8d82921a589

SHA512
e7969e7c708ce19f624f338eff9d178deb095f87ef7fe635f2ab51f86395f9a1c7815c69a5a7fc63c4e9cd9bd87fb267514e4264665ccfcac24d83b5b754dc57

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
156KB

MD5
b3236e594a2446b3d7041047c89c77f4

SHA1
a8faa445de282078df62049b1c89d72fe06c091a

SHA256
541dfd43ec4978e030e04a76afdc0f34a5db1d98b890366806c284f04731237c

SHA512
6817f06b38e4c1bb8c9ed1c02ec1647eb4fdb21508ca02a9e871bb1797ebed1db285cdb539ddd913693cb7ed3aabfb01d160cfbf41061902ee129b596c17150f

Download Submit
memory/2368-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2368-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads