6920fbff97890e934f25fce0bbe3c8e6e0039fc8119171220045a39949c1c613

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
Size

100KB
MD5

93ba3372a32601610fcc1115b1cbeed0
SHA1

81176c3587d7ad4f170c43c7159d89813c1125e4
SHA256

6920fbff97890e934f25fce0bbe3c8e6e0039fc8119171220045a39949c1c613
SHA512

a53db24efe16f516c4aa6dcca038a139c50dcfbee34c856644513107f6f11642521fb1c3770961d28e6493c5b7ee27012594c0a808541833fd70618ec676a6a3
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hf4AI:hfAIuZAIuYSMjoqtMHfhf4hZ

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5033) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4500-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000700000002327c-2.dat	upx
behavioral2/files/0x000800000002295a-6.dat	upx
behavioral2/memory/4500-1096-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-140.png.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Primitives.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsFormsIntegration.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\limited\US_export_policy.jar.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-ul-oob.xrm-ms.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es-419.pak.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp	93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\93ba3372a32601610fcc1115b1cbeed0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
101KB

MD5
f2a88c4b437625ceadda2b45e3978a2f

SHA1
d502bfd45b6b02e50b29dc732210c200e160983e

SHA256
b97f9d45f7940506696b7902dafe49f115f0e5bb5ec5b42ea8da43cddd21558c

SHA512
78379fab3fdac7bc0334990ca58929e7ff671ebfccc67ce1509a00df83e0f9d47c9d4ec9fc0d3ef36e0cf571162fc8c342cb5eadc4ff560d556ff13f3f0cced4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
e9ed1c00bc3a549cdbca7519f238fa7d

SHA1
25c7722d7ff52c7f3939504396e43dd9cfd13e1b

SHA256
c196a68f6776e637c4bbcc0251e202ba2dd39c0c04d95380c5768dd652b96511

SHA512
f6d81e0d522c39ca06d73e8a7d655c95411a9cbefe48b768458ce170390582a5a870dc70e05f246231c3f7bd62238985c0befbd1ad27a65db5c21c8734a935f3

Download Submit
memory/4500-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4500-1096-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads