4dfc11915fc8aa1d31d6132803fed0c69d6b51d44c0de5aa1fd840ddd009aa07

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
Size

138KB
MD5

55b902397ca78a49c09c1e62bdbf68f0
SHA1

12688dc6ce9d0dc01bf4fdc81810d8d0b4980ea9
SHA256

4dfc11915fc8aa1d31d6132803fed0c69d6b51d44c0de5aa1fd840ddd009aa07
SHA512

db954210787726b8dd2cd71b47df08b1a4cfb4efa663550686d79db78734df8a8aa5739c7a98fbec295a35e9832797defe9a8761518b9f04444f9a5a11318010
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCC:+nymCAIuZAIuYSMjoqtMHfhffPn

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (519) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000014e3d-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/1704-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InputPersonalization.exe.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcfr.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tabskb.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\55b902397ca78a49c09c1e62bdbf68f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
139KB

MD5
3788e62c693cfeec4d2436c34b782cb0

SHA1
c2722a520b192a0b220ca547c68764e9c1c21561

SHA256
94b00b59933cf91d786f205970396a4e9aa5117210a7224277920816c128f4f2

SHA512
99781eeb4f0bc8c842e808f708b3c72f4cde5de96366b88963417a559ab214a2f2075c97e9384453d665aeea59bdfb2923a069689fbc98e07a23fadaddfe15be

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
147KB

MD5
9cc865261382b99b3cf53ca9846f49f8

SHA1
99296a23096707bc31ef36a802a662fe46fa199c

SHA256
19c0a1dc58b8d65267913230b26c051ac55ce70621be8327d085b47f065e81b3

SHA512
7e8c966c21bf86161c2252014a42d19ce4656fa47985e892e7cac54a93360858efceedc25eb88071d702f70ef8b65a209dca4b4de45861bc775354d49cb97e87

Download Submit
memory/1704-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1704-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads