693af631163ee5ba474d0250afe5623f1b815b6622900e210a8288ab2671d408

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
Size

124KB
MD5

5425587f2cd4c5b783b40e976aea7980
SHA1

e5d52f16c9d8d7dccbe35bcc482ad6f608104111
SHA256

693af631163ee5ba474d0250afe5623f1b815b6622900e210a8288ab2671d408
SHA512

fd54b100c3e7d555a6d2e5caec1b67ed38fba96e01ccc3c5691349f207356d2ac161dd590b4e02c17ea5e4c2f0520287d4d0726c32ec9a0d77682ccb105b5ecb
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCb:+nymCAIuZAIuYSMjoqtMHfhfu

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3429) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2164-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d0000000144e9-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/2164-650-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Madrid.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\London.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\accessibility.properties.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\tipresx.dll.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_ring_docked.png.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ie9props.propdesc.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-text.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tabskb.dll.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jawt.h.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPMediaSharing.dll.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\es-ES\WinMail.exe.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.identity_3.4.0.v20140827-1444.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmkv_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Winamac.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5425587f2cd4c5b783b40e976aea7980_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
124KB

MD5
b237bcadd7539d3909a201cdc3954091

SHA1
be9e65499327eacf3325b1ff3b9ba677749f9b20

SHA256
d354a57915f7ede19297b6b57c96f14e7627aecc86592605fe82f088f7f2c5ae

SHA512
3de398217ea8b538ca68c6000d85a8fd335fdbaa087386736b2bce1b70f5fd24af64158de74333b5d32c5df74bb0928502032973cddbe66969ff78d4fdce8fe1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
133KB

MD5
10f2cbce4f855cdb9dc7700e25ce4e6e

SHA1
acf2418a3b86d2970262f24176586ba1d455acd8

SHA256
54f3c9ea041305d548cdf65c50c05af7af7a12f02a4a8f7793f74cb72aa832b8

SHA512
59f3ea3eb25a1d879cee9f027d71342218b273ebbdbbebc29aab9b78a785a8539640db593c524e09adec050eddab14b79720f0553f5284489352f8aca7c0f247

Download Submit
memory/2164-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2164-650-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads