2b623b725cb043efedd41d70f3941b8bdda49d4c26ea0a404f842a526abf5608

General

Target

cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
Size

59KB
MD5

cecdae45573a357ca8193d2399fe3810
SHA1

bb296cd66f69c14f965f1d840ee583f72aa8c831
SHA256

2b623b725cb043efedd41d70f3941b8bdda49d4c26ea0a404f842a526abf5608
SHA512

59494b52e27912bfcf524ce44c7f2001a46f409970e89098c1aa49c4aac862db3dd20e4c9ab59416f6c5df9327eb3463763e58089153baffda747c497e12fad1
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFJ:CTWn1++PJHJXA/OsIZfzc3/Q8yi0azU2

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_de.properties.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\library.js.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayenne.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Yakutsk.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\mozavcodec.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\flyout.html.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPSideShowGadget.exe.mui.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kiev.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Resources.dll.mui.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\Graph.jtp.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\WMPSideShowGadget.exe.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\slideShow.css.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cecdae45573a357ca8193d2399fe3810_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2420

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp
Filesize
59KB

MD5
5e27e460ee52ae56a3cfe91918a29f05

SHA1
825179c2c6fda401bd5dd964e2807c7d790e28ce

SHA256
e2bf20d2e4a6b2cec12cd92bb19cd1ade18a562ea258ab00cb9a7ca6e80a465e

SHA512
9140d1df8a3b54a8e9850108809fcdba99c05ccaf84b5c114c871f0ed4b5ab8ce792c9ef296be09f7ac697e538eb2b374f179db4c0dfd5be51b663a1171e7b8d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
68KB

MD5
9a524a145b206ddcbc913a7782c4f59c

SHA1
aa56a1462dc0e9818ea34caa211094362ca5258c

SHA256
5024bcacbd4c0f2c5924cc5769e4c00ae691723b5cdf85dac39be5c4c4ff2464

SHA512
fb312541c620b290608361866ef48549a84209bd158d2675313bebc67809f33501653099d4b1f08a3c53de072b88902570897ad65d0290a1f124dae57ebd75d3

Download Submit
memory/2420-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2420-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing