f6c65b2d4ad63fa1f1894a29c581b69178030d519dfb8cb09ce1e98d56d8fe75

General

Target

a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
Size

85KB
MD5

a481ece91f01543f0440fd20ce50ea50
SHA1

71f2d68d4f9955a98e1acf6b3424d3d87be2df86
SHA256

f6c65b2d4ad63fa1f1894a29c581b69178030d519dfb8cb09ce1e98d56d8fe75
SHA512

7af699941edee4264b8e67ea0fd08493d34186fc1d5520afcb22dd9f7767337c035409e2eab503690f111afa89d929fbaf34251ab560fb4b8b735a8101feae22
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiDC:+nyiQSoiC

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3522) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2140-656-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chihuahua.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Malta.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dcpr.dll.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-templates_ja.jar.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\deploy.dll.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-attach.jar.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\CST6CDT.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\RenameDeny.mpeg.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page_PAL.wmv.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\settings.css.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png.tmp	a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a481ece91f01543f0440fd20ce50ea50_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2140

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
Filesize
86KB

MD5
96948d77993ec162f87c1472e2dc1bb1

SHA1
9fb8d6b993c69d60ac5a8115478bea280bf58108

SHA256
d16890ece17c7b061e3765133cbb0c671976db2c8d7c1cc3824511f03ce71f43

SHA512
aa3e2a2e1d7160e5a092180ccfcdac46864ac25e87c11e14b081b54d5bc46746eae0e1ddf5a67af3bcbf0f18bfe662b5cd7ff9bfa56b68719ddb701d1ec89f11

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
94KB

MD5
037682998abc9949d2be70537e082097

SHA1
bcc4145d0c04175ffd11946549c82f31c1af12a3

SHA256
d46a0ef5b91c718622a3a6b9331d10532be1aac784aef037221c38f1d0dba96c

SHA512
bfd528093d9b5b4709a6a6019a0d5c6070a7169446503bc34fb0b3cc37e739b51b378033f9c74c65e2e1a6892cf72b5a0da8dc8306e6b16df5f4e0aacd1554f6

Download Submit
memory/2140-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2140-656-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing