f6c7db0dfbdd98c284e3c5f4eadc2475939f0274f0c52e554bae4d960b6ccdd2

General

Target

7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
Size

103KB
MD5

7342fd9fb34dfad1d7e616fd42140060
SHA1

0247c7d85c43e9cd6fb05c069f25b59479f1f4b8
SHA256

f6c7db0dfbdd98c284e3c5f4eadc2475939f0274f0c52e554bae4d960b6ccdd2
SHA512

6914d4e93e0b1e63924f8d7b1fe2b87647d1a6e6a04cc50e94112ab857caeb33938562cad0f69348338b95cf16828be9d2befb4edb9072702f5c65b3b38624e9
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q89TWn1++PJHJXA/OsIZfzc3/Q8/:+nyiQSo+QSos

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3305) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3060-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/3060-564-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Client.resources.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\rmiregistry.exe.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Funafuti.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Inuvik.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\splash.gif.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mazatlan.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Riga.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\Welcome.html.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tehran.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Almaty.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7342fd9fb34dfad1d7e616fd42140060_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
104KB

MD5
9087e57808748f9c0dae68eb65833222

SHA1
358569b7538d87fb1774b92097c236a6af6bcfd6

SHA256
83999ddfb685270c790c753b5807d14e09e647b1173ecda456220743e5ce5698

SHA512
65512b186066e028100b3e9c99741f778f3353db8dd94827970c3007879c681b7c5fafcd983d71164a28389a164d26e84c7c900c19cad6de6838595635a2a2af

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
113KB

MD5
5d47d0bde06a657f2e99e6329c3444ed

SHA1
3156ff0eb87ec8cf622489edaeb714bc4b3ba19f

SHA256
3a9363f1aba8e4325b8c7dff12ddc548b5b07956e5010e167d519d78354aa4c7

SHA512
49346ec7745170bca7b69a66ebb422b422624595e5257a2c4b44bd59abe63562b42629ee89da29b6755c89364d9ff82986cc54150b3e2c9373a9c9761cfa66a9

Download Submit
memory/3060-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3060-564-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing