69f98bfb43458cd47bdedd6b5aa1b79494f6c196c71abbce0c4ff34efdeb7f1b

General

Target

4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
Size

70KB
MD5

4cf76a49efc4f88ff48b23477edb4a80
SHA1

2e7629340f1a434fa896510cfb9f01fc2d8b3484
SHA256

69f98bfb43458cd47bdedd6b5aa1b79494f6c196c71abbce0c4ff34efdeb7f1b
SHA512

b8292f38339bea8ca900ae3d6ddd24b2e11c24073c9ac13a72d0ef021fa619678267ee83f6a076a35eb6eb56287664292bd298d4760be28661f57b5586b3fbc6
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUs18/8T:+nyiQSohsUsOkT

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/792-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.chm.tmp	upx
behavioral2/memory/792-1960-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_school.png.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICI.TTF.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-pl.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotdintl.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ar.pak.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationUI.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MTCORSVA.TTF.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-140.png.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp	4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4cf76a49efc4f88ff48b23477edb4a80_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:8
1⤵
PID:4360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
70KB

MD5
ad4c40c9b1e380423b5d8926b3d111b7

SHA1
ca40c4c7bafc855de6fbf6d398b8fbe76f7702fd

SHA256
d607ff5f78bd1f9567342dfc5c23ce15ce2de7f3a5c5376bb7886e03b9c0ccfe

SHA512
2cefb66f80b54b527d329614062e7f64d0d0d5686a7240edd6fd6e16a9152a10bb618733c9730c72768db6b75ef6f7093f4df7af1108c8ca5920390190892333

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
182KB

MD5
a1d4ab0989f874f807dc0c141ce2f532

SHA1
4b25b38c7f066820acadd4af514a9a4602a9fc01

SHA256
97a904186aec5e9b7eeba9cb5925bdf2a653e717399ab826e86271b40e051d6a

SHA512
0f70e9bb5cb74f9a90cff916d2f27a4e9b57f443b0fe0ccbfc45682f4517d987de852aebef1c5a38038e6a0df3381b22307b7d9479cb0520b58348ed5d4e0cf5

Download Submit
memory/792-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/792-1960-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing