d75795a94a811a4a6195acaf92d6b294e59edc1a1f7efd2f5741f388fb47d91b

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 09:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
Size

47KB
MD5

9b2d16d907e5af463f99a6ea8730a490
SHA1

89e7904902a2a0236bf0f822d6759e5d0026094d
SHA256

d75795a94a811a4a6195acaf92d6b294e59edc1a1f7efd2f5741f388fb47d91b
SHA512

080e413595cd325d4f19a1b2ba1e945154e9fc71b4ba6ec6f638967a6a19a12f20e825bcdbadd2ba610f5a0d4b0c9130d0a63b95208187504639ed34a00fe68c
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFaD:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe3

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3773) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a00000001211e-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/1700-82-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\calendar.js.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.Speech.resources.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\gadget.xml.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\AcroRead.msi.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\mpvis.dll.mui.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\nio.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\setup.swf.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSSOAPR3.DLL.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\meta-index.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler.nl_zh_4.4.0.v20140623020002.jar.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bogota.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Chita.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\picturePuzzle.css.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\CompareSync.sql.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_disabled.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\settings.js.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\cpu.html.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9b2d16d907e5af463f99a6ea8730a490_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
47KB

MD5
abde8525bbb914da9e4f39cd9911adb6

SHA1
fd5348923cc6d61c0a5253718fff74e6bb8db64d

SHA256
3926a61d6d78c4ca460dd0dc88a90327462e41e2e22121ab8a31be1811f11595

SHA512
181ce41fa52ecedca04dfc9a87ba5f1fce13092376cc0207cf98b50630b053dd15a34d07b5a1a8ea5fb6dbf6abf77d1cedf381feedb6054000952fe1b2581424

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
5b7a67487a8f6da07cabf17826ce5172

SHA1
fa7f755557b19e178b38970a8767f8818a28d59e

SHA256
500bef89326294a9f8893addfe46398efc4173b73024f0146c58773c0695d902

SHA512
ba098895d05a17b47e436e18fd5ec53680793b52b7e7866fc3f685154455979ba478392db5de3915e633bcebc34c294ce36c890e2594b4afe226ae8fbb028a47

Download Submit
memory/1700-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1700-82-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads