d311d7ae5e42396752251a75f5bfa725652c1d94fedcb407e92e32758412a86a

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
Size

132KB
MD5

47c8bef60557ead021e1bcf6ec9fc870
SHA1

01055bdaba558acdd5efe99573d5fa156d73d035
SHA256

d311d7ae5e42396752251a75f5bfa725652c1d94fedcb407e92e32758412a86a
SHA512

cb5da390e8b8a04020ef3774e4ca8a59687ea3dbaf6f8aeb69c2e869da5c7d2fa89ec7999e188e1e9ebeba6465aca1a3d993731a01389dc7e67d7c7fc90b4c83
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCR:+nymCAIuZAIuYSMjoqtMHfhf5K

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/308-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012272-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/308-642-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_ja.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.ServiceModel.Resources.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Nauru.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Damascus.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansDemiBold.ttf.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\47c8bef60557ead021e1bcf6ec9fc870_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
132KB

MD5
77efbac66d8d479ba4d3bbe0cee88b1d

SHA1
8fc98a3e7529471810202fa17172c59527b13578

SHA256
e2f8865b99536abea6446c7ec31ae5aacd4e186af67c8eca87dd49a84701b701

SHA512
9e24d92111f029f120a160ebfdd29b043d583102ba670e6e4df7cc965fd131fbed4528ab22087d0bfafe6080b96323ac8f14f41798d4a155e4de0acff915f7d4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
141KB

MD5
0d68d96dcd9167d99d89e65e18647800

SHA1
6aa87372f1f2d2815aefe96bf493590f8caf41ef

SHA256
29a7dc4f4358ce53402cdb7d5d30f3f36e9f19989b5f91e35dcc1b3b67ff49b2

SHA512
94070f383c9c97a27ba4a6e1ed6ed225540ec267164ee6ae9d989629d770e988b9a0d0b68566bece29a81bfd1b24fafdc4c25f46f2217e69786684bda6b27f1e

Download Submit
memory/308-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/308-642-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads