6b31e61b30b5e6af3c0bc08460b7a016847a68c8468b2f3029fa24e3d15d1f93

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 08:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
Size

163KB
MD5

a94976dc0c67482eeb5e69420b247740
SHA1

6f652958fa8a851e6c09aa96d621cee659d4b1fd
SHA256

6b31e61b30b5e6af3c0bc08460b7a016847a68c8468b2f3029fa24e3d15d1f93
SHA512

dedbdfa8d75f5757601e2a35ad0cf05d258df5326eae6bc9b3bff45429baac1f726aab9fcc1a0ee5fdf1cc530871bc12ac2e351f64b6a287dc068ad5d7ee1757
SSDEEP

3072:+nymCAIuZAIuYSMjoqtMHfhf5Ssk/6nEJgbe:JmCAIuZAIuDMVtM/XSePe

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3267) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000c000000012287-2.dat	upx
behavioral1/files/0x00020000000106a2-6.dat	upx
behavioral1/memory/1704-584-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\trusted.libraries.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nassau.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Lagos.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DisableExport.vst.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hebron.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Ojinaga.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages.properties.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\CET.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\common.js.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a94976dc0c67482eeb5e69420b247740_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
164KB

MD5
09cdd07f4941ad5a62029bf8a78b0dea

SHA1
a171ff2649e5c94b29d6964fc3e7db49fb87e915

SHA256
0f8800da3a1b801e13823494908f7f4ea4034f4bbf7bc6128e003d55edc2220f

SHA512
6e22361f80bc32d126177a341225861f75809be1e146c6b67189d87717295e4a9a6bdd3f35e5d03aa6526b6fba52fa068533f800f4c7a1768cb28277efa81df8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
173KB

MD5
9f33e40edd041178dfbc63bcf476130c

SHA1
d683d96f44d8b5cc03ece523a8fece4b339e4a64

SHA256
05096b0f28861a595be2d5a38f82ace72235cce0b951dfa05d29675645ffb1d1

SHA512
a7a7c5d409ee38852de5d825e9da92b84953cd2d1fc99570a28958ef08d5045824a68fa69e38360afb29145f4e837a83749ad8ffd99859629b443e0e8f4b0644

Download Submit
memory/1704-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1704-584-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads