e2c1f60b7896ea29f08e7d8aa1dea5c9cdf3c9a803e83d9102df634f5d331379

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
Size

103KB
MD5

4a27be827d046ffa1fd92f1f3df080a0
SHA1

4af1e99da851dec9b8f6b35f60af16291a71cf22
SHA256

e2c1f60b7896ea29f08e7d8aa1dea5c9cdf3c9a803e83d9102df634f5d331379
SHA512

c1af50bdfacdc69b3b291da5a602652a4f97c81068483ec06b7e74b69ada3712ceb5c648899a9a4b152754f860a092ccfd48cc880fa7c685a3b8f8bfdfe68e57
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfb:hfAIuZAIuYSMjoqtMHfhfb

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a00000001211e-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/2176-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
103KB

MD5
2ff6ecb4ace5d11c306417fe3eb41c9b

SHA1
42d97191327638bd0f8bb31db11ed910dbb6a2a3

SHA256
2c2a9b84b44c5586a5842ac2f2e632f98018184adc9d14d098c588f3b72f9765

SHA512
8901cc49b59ad5f3562d11945ad6167f248ef7c9b3556667bfba8e688fcc0efd162064512d460d696681f081adc7477496d8426021dc24893731a78f0047453c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
112KB

MD5
971c73581acab47322c3c5863bd66789

SHA1
ca46e25582f65dce535dd205ed322186a316b0ba

SHA256
fa8d7f748406f90eaa4e980bf6a47a20afab470f1df48ba8c028e054b1abcb2c

SHA512
c1f3ffa95de1d427ab63a8580a0c1794f04ed037c8e81724325e497edd486e742e5a0596329eabd9f786bfe0691df981b71e13ad2f307ef2fc63e722b3fe4476

Download Submit
memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2176-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads