356af02bd2956d7d2dbd84b4cdc70f1435030bb445a9b9f4824f2627aca3b770

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
Size

73KB
MD5

505588126151fb79bcd9aff9140eb040
SHA1

7d3b089716c8fe392fe2f60c485b9b2b49a3e368
SHA256

356af02bd2956d7d2dbd84b4cdc70f1435030bb445a9b9f4824f2627aca3b770
SHA512

c83a8d9ca7d2fb2c92e718b2a973f399bebe80a78d8a6b370141b31a6000d4f724f98324075f422b3c2d2e05fdd3d5e255b1768b9f2bf6b3c2e21872ab1a8bcb
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yiv:fnyiQSo6

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x001000000001226b-2.dat	upx
behavioral1/files/0x00020000000104aa-6.dat	upx
behavioral1/memory/2180-648-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\wlsrvc.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\triangle.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\awt.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\ChessMCE.lnk.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IPSEventLogMsg.dll.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\LICENSE.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_bridge_plugin.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libnfs_plugin.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\init.js.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mip.exe.mui.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST5EDT.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\505588126151fb79bcd9aff9140eb040_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
74KB

MD5
81325cccca8da58f24b891b754cc694a

SHA1
6c13b7e4b559544ae462fc44a4de98e0143ff0ae

SHA256
baf3ab0ecb33bc80727de360ef023f5cdad8f75ee45a301b442852cb606722b7

SHA512
cf0c25eabc13378e6cadace37d1c7ebd44106a57acb8641dccf9a4b9b5a5ac2e11b9273c1fc3101313d926a018841a5bd0070db7070cbec5a8b7fcdf4f7defea

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
3a2822568fb6a1c499b73ba4dbd854a8

SHA1
459da48fd9dfbb8a0a9d245a0d68f2a6677e884b

SHA256
ba6aa8d4da30fd29058ed25244c3d4d617f9dcbfd5a5e6a15a9e8e154c749a1b

SHA512
fff1bbd11dee75003b1db52739c72921ad1e093f23f5931529b39fee97c7e9964a20107c4da36033363d31c2eaf9797fa9b2d95430077c2c1f7f28507c490872

Download Submit
memory/2180-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2180-648-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads