6fe9f91eb021d319ed3bd320fe6409cc60281af87b7b797a9d01defa207cabe5

General

Target

347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
Size

52KB
MD5

347cb6099f2c8457a1a8dff4f3bc3960
SHA1

be4df16b13f796e8232add826144ee1d925951a6
SHA256

6fe9f91eb021d319ed3bd320fe6409cc60281af87b7b797a9d01defa207cabe5
SHA512

0601e72fb0396c8c0bd7edfaf7727a699c285f59e2ac2164cfcb950a774f0ce56e3aa85af45f05d951b3d486474b46a2670a1af2c07527d5fa725a5a87ce66f5
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFr:CTWn1++PJHJXA/OsIZfzc3/Q8yiemx

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2908-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2908-18-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\es-ES\MSTTSLoc.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\d3dcompiler_47.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\ConfirmMeasure.xps.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tpcps.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\347cb6099f2c8457a1a8dff4f3bc3960_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp
Filesize
52KB

MD5
adda288f5415a70566b3f39f0613d7a4

SHA1
776c6dcd7282c8d4c0e664e61a8487709e0a5b28

SHA256
1b1e41335a5f199cfd02e5a5fdf684aa315989b8cca0edd0778da5c5abe62dc6

SHA512
488668d72dbeb8e1654c8ec614df220ec27cc0257f886eee4c271028cce7433a573c2062e47dfe6e5afef286e53d81d5fbde9810e4178e80fd44a36bf03e18c1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
61KB

MD5
3b8200520ecc3ebe621c0c7dfaa7a8f1

SHA1
51e7adef5abc33f4b0903880e4aab2710399d0a5

SHA256
6b96114a13ae67f7f84feda9e21a8dc3b3a50527d7bee13111dff19f45f8ef87

SHA512
dc97063745ca07a4cc836228b5a568b61c5c9a7d8cbbaa3c326805d29c57f6eb5fed884d81c422418e3c45006a86e0ee59ec93da81e6c70a514bd23cddad9ff4

Download Submit
memory/2908-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2908-18-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing