337844a68d5408e7f1068f991f4ec9f5089626ade37d96b76442bfa7198ba470

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
Size

99KB
MD5

8d0b0eebb75fa2339d5870bcafe3c660
SHA1

77bebe68652de9f91f418a687b71e35f94ffdd5c
SHA256

337844a68d5408e7f1068f991f4ec9f5089626ade37d96b76442bfa7198ba470
SHA512

9da2514f49747a4e3bc80dc458b0b24eee8aa1adef53baf9280bf93c0ce463f9dd08b0e56174ce19f283473345d9b02369da6b071db16e7f5cf9cc544de4a073
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf5S5:hfAIuZAIuYSMjoqtMHfhf5S5

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3450) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000013413-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2100-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\it-IT\PDIALOG.exe.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\calendar.js.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmti.h.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\appletrailers.luac.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnetwk.exe.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\setup_wm.exe.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\layers.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-GB.pak.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state.nl_zh_4.4.0.v20140623020002.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdcp_plugin.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\msvcr100.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_WMC_LogoText.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8d0b0eebb75fa2339d5870bcafe3c660_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
99KB

MD5
8525dacc8bf7d71569581a8f0621f7b6

SHA1
66f06e53aa9b6ac700cc798c56f13e907e817f5d

SHA256
c555036a47651be91e01e4eaae24261ef4e320aee8008e7f6a204d1cbc898245

SHA512
c4482c94dbeec865c4af6c8f86123f76b55a523eadb8ba3ded0e737cbe11c9390f695e901cee315d56e9210f37a30df988441581edd1bb328ebe7d3acadd1f2f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
108KB

MD5
d4edbda7ac826839593eadeb2b7f32a1

SHA1
f6638cc69871a283f59edbd961cff1da45a7debd

SHA256
3a0f3e858690bf0956a408292226f1b52b51d062774bfdf6225dd4895ebc3231

SHA512
1b0397fe4ee0bccc102db7887c4dfb23c41eaf743a39fd8e25821180b80230fae3337ebc871f07b5d092c7f54c7986b8612ddc67d5d1a5075d98f320e57f2860

Download Submit
memory/2100-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2100-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads