8e4eb4737b287618843f465d0b02a9a3242b24f9e47ee27732c42f822c3f47b6

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
Size

106KB
MD5

ef80f5ee00761e8c506b2976ac6b1760
SHA1

51c2b3beb02ed7464e354f15e5498186809811ee
SHA256

8e4eb4737b287618843f465d0b02a9a3242b24f9e47ee27732c42f822c3f47b6
SHA512

0c4a75621b5d5abf73485acf84fdd4c3b3e2c069391e1b838d2f44e66bd9ac72e42a652b4460dcaa35e932d82c9a6710ef32cf6cfca889fa9ab6f3fa7ebeb0eb
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfRba:hfAIuZAIuYSMjoqtMHfhf0mQmo

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3428) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000015cbd-2.dat	upx
behavioral1/files/0x00030000000104b4-6.dat	upx
behavioral1/memory/2312-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Client.resources.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveNoise.png.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\clock.js.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_zh_CN.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_flac_plugin.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_zh_CN.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Rome.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoAcq.dll.mui.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rankin_Inlet.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\tipresx.dll.mui.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar.tmp	ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ef80f5ee00761e8c506b2976ac6b1760_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
106KB

MD5
6dbccfaa981d32cc05b983cf85f4b03b

SHA1
46a317209013bf6c7a4b0026e567983ec970b9f7

SHA256
d0d4064122ef9956819a85a0d22d6e8217713df41bc7d75f86bcd96f82e3fda8

SHA512
85ae19bbab8bbaeba840aafdde1d34f0abbfc88571dd0fc883f8889b16fe9406dc3ad6b71d4b1843df7ea1883430545614af01823b8bd70b80159543dd41b6e9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
115KB

MD5
1a4190ca2c8b11971fa43ac2ee2df618

SHA1
a78643467405e830a1549add5c717f303f78a9e8

SHA256
5be2401c16cb213b7d08c2cae93e077344f8fbf5b13ad4cbdb9dc1552981b3c0

SHA512
02df48a3317790e12aee79c8d2bd3d2cbb5a05008383af781ba6c4c0533c9a073ede36af67ef84ed9a22c058b068a6766d46924984433d037246d95bec72a5ea

Download Submit
memory/2312-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2312-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads