615c65c26d1bd9aebeb53768bc3279d7c0eebae92f6de1d0120e959c79fc910e

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 04:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
Size

97KB
MD5

77823768bf3a98d22049003c38b85ce0
SHA1

221883dfa07db240e1fb50bd935c741e3b9f79de
SHA256

615c65c26d1bd9aebeb53768bc3279d7c0eebae92f6de1d0120e959c79fc910e
SHA512

74eb7601dc45f87f6bb86d2a8df4afde528401ed83d558fe6fd73ba7349520bac0dbd3a1a2c86ab79f3e5af8bb124e6417ac4836da58cd75315161011f580efe
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf96D:hfAIuZAIuYSMjoqtMHfhfY

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d0000000153cf-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/2172-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\fonts\TwemojiMozilla.ttf.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.descriptorProvider.exsd.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1655.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Menominee.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\it-IT\Sidebar.exe.mui.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseout.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dt_socket.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST7MDT.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Windows.Presentation.resources.dll.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Whitehorse.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar.tmp	77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\77823768bf3a98d22049003c38b85ce0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
97KB

MD5
d141fd3e33b9ed1cb494eb594d61f70e

SHA1
6977973a15ce01e364b53b15beed143f5bf9d020

SHA256
7cab84b7ce9fdf95ad00c76a3f87d51142df33d92cb07f438e045de41f2ddc4d

SHA512
4c3824da1654535ed60ca70199791b1468312d4727b11aced02247fa1e076a3b1003b2a6abd0bc2ea1ae068725d64d25bf28b67ed47bd269e50fa22aa0ed50a3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
106KB

MD5
7c29e5417d9130277661086f8296574c

SHA1
a5ce6f0886c289514f1308ccc7f6d8ed504a7529

SHA256
cae84edc253d32b15726c32aaf12b29aa24298b50dbcf5fc382b1e5c5282af83

SHA512
e35d8ff2694c654094c9e4945d6d8404b47ea9779c04dc024ccd6d43ecffd98e24b4b0e288b4d0be6b3932c244f064ff33644cb0ef449b6ba4a8ace1f485d0f4

Download Submit
memory/2172-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2172-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads