752f009ab1ae2932967911b1201581328b0c848f08a4230fec6b62230c7c7d7f

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
Size

105KB
MD5

3970aba6dfcb3bce98b2f861ac6e7a80
SHA1

51342f3c2dd16c12f9a3a34e72b4da73c2615829
SHA256

752f009ab1ae2932967911b1201581328b0c848f08a4230fec6b62230c7c7d7f
SHA512

47993f74f97d6d25ce4a13cd9242189069f0cb15d03ad40b3dad4494ffa7f798836436c8fb19c887cd394964ce1cd735881b233cb041d3a486b6fa2540a145d4
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hff+X:hfAIuZAIuYSMjoqtMHfhffP2

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3446) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000b000000014457-2.dat	upx
behavioral1/files/0x0002000000010679-6.dat	upx
behavioral1/memory/2912-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Anchorage.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chihuahua.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_zh_CN.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libfps_plugin.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\fieldswitch.ax.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector_1.0.200.v20131115-1210.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Resources.dll.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Eucla.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\tipresx.dll.mui.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.tmp	3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3970aba6dfcb3bce98b2f861ac6e7a80_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
105KB

MD5
038b5dd80e2c1a16d6388d0f2a2226c1

SHA1
71ef4efe2e549165fdab68b950c7ca1701a7c583

SHA256
3bebf4398d0b33671623c8923f9180a471b27ffc4e97d54922df71614d9a2711

SHA512
e6d31b0a8b9894261dfd8c1cc21632433ad7a04347b0bd983c3bf5467c95997d69a6d590ba0b3063f7d6522fa2170f65035366d9312888ba18197ba74fe80f14

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
114KB

MD5
dda15ed2398af7a99bc0939b2c699a19

SHA1
933a690dff110fd34c1139185932add6ccb15eff

SHA256
8d736cd7c91c9c7a0851c044ce50f8ff1135f7b9719de2cae4272a8588f0c9f5

SHA512
d47329b21061672ff8d6fcfe23d9e29c18c09e47a3fc46e61c316d88ad1717d9795fd417ea869828ba3060ab47a60846b87867d18ddf51557452ec48ca81a385

Download Submit
memory/2912-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2912-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads