506c7a1100bf769ad195b2579299943df5317cc8af44d9878ad37b6b03795160

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
Size

129KB
MD5

4ab902c2cc0a98d2f4ba204aa55f2ed0
SHA1

14494efdd21f1db0c383cead0f5ef4541714d5c1
SHA256

506c7a1100bf769ad195b2579299943df5317cc8af44d9878ad37b6b03795160
SHA512

cd975dea44f46099e93600efb211760369cc77551a34e5b16a13d7f1b413eb1b602a24c5f0b81539a8caf3539d20784a75a47af10e74461e304f3f08d2173912
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCn:+nymCAIuZAIuYSMjoqtMHfhfq

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (516) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2148-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d0000000122b8-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/2148-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\v8_context_snapshot.bin.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonSubpicture.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ab902c2cc0a98d2f4ba204aa55f2ed0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
129KB

MD5
fbd8e81f3ece981f6f700040d082c132

SHA1
afd2e8a9d38978842c4e964e87976f247d76dab1

SHA256
8b57a50c54c123ddca02490dc9b27054bdace0555df3f1a889dee7aca23d7711

SHA512
63bb2e60107f99537529e12df518c43cb89316621c0e6f43773510d5139762de423161fba89e6fdc2230cc75ea09b528005781d5abac5fa718b9ceb81d5491b7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
138KB

MD5
e78f7e8346f0c152200274d276c50a9e

SHA1
d9b32a4b6b9b69ec52a0fcf224b8a9e4164b72f0

SHA256
ec084537d708f12cecad094b7bd355256c48c9a2f53bfdf906fdeb4588234ea1

SHA512
4430d8dca1c59393f66193cfac3260b4eae3d72838a001f1a6734d76d59f7cdb9b221b3d7754d102e149ae6e7a30bed7ea9a5b1e3beac20eae381949346cb392

Download Submit
memory/2148-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2148-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads