dd3b32880aaaa34bd3ecda1cddfd4c79c44b99c304edaf6da70f995ddfd58d8f

Analysis

max time kernel
151s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
Size

111KB
MD5

e1c3cd7af9a8cf8712193dd8d1c095a0
SHA1

ab2fc6a8263734f5eab3795e7e9ac7d5183b969a
SHA256

dd3b32880aaaa34bd3ecda1cddfd4c79c44b99c304edaf6da70f995ddfd58d8f
SHA512

6c049c709dae2f48443ad5f716465bf31a176ac28e8815676809ce067116a5c4631c7d001dd72e30e111b6d27d98c424d8271477e616245b7dd237ff61dcf646
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf0x0:hfAIuZAIuYSMjoqtMHfhfh

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (471) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1524-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c0000000132c6-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/1524-26-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e1c3cd7af9a8cf8712193dd8d1c095a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
112KB

MD5
f59fff89c255c2db5f685bcb67293544

SHA1
a08ea0e611ee2fc42b790ca54514a2990100a63e

SHA256
8d587e1bc1b2bfe61a683526412f66495f1ce0957303aeaab68340906878296c

SHA512
a73f3b1c00996d9880986ecfd622ce9760cc9aee3e2554c4b53b55c4b2ea91ccfea9be1a5d88f2a988f435dc5f6197ef94f9b973500a818bd058580560e43bf0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
121KB

MD5
f58be625f53075db7f8138a8f753a027

SHA1
cb4c37117dce8dcfa601acd999f6cf6aae450222

SHA256
08c8c3b728c84cbca4db768149c74b30cb298907259edfb278b8e2d7013ab51e

SHA512
fa3f7d763fc7cfa97ef6ebb6d318841b3ca0b301242a29f321d58c5dff29d646df51b435f1557477be3c80f8e49663b5f924ee713d8cc619b97cfc33100b8e1d

Download Submit
memory/1524-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1524-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads