1ad723d638e7bfccca30614d479c027cba87f754e432c52dbb2869565835a54f

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
Size

71KB
MD5

f87d0066a531ede8485ca09c7e2af970
SHA1

ff9b501e2806c469c26eb8ce7347296582715714
SHA256

1ad723d638e7bfccca30614d479c027cba87f754e432c52dbb2869565835a54f
SHA512

7bdad968676e6b35d4ed57813b0fe7bfaaebe47c6a3f37fea19a9cd12796b15726e903bf2c4140efd14c3aed05b1b3030cd96564b24693326175ad697fba4ccd
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8H+Csqrp:+nyiQSo2s+

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1488-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000a000000021677-2.dat	upx
behavioral2/files/0x0008000000022970-6.dat	upx
behavioral2/memory/1488-1790-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ppd.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\EnableUndo.txt.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\resource.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-phn.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp	f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f87d0066a531ede8485ca09c7e2af970_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
71KB

MD5
5ba250d6c4df9aa5ad33f89cfc7dbcaf

SHA1
621ffc6ecd0a57e0272427d50bf37c1e4b6883d3

SHA256
2082a0d308c9081221faef7fa4c5e9fb138a01d0ccc475474112e48a288e130a

SHA512
a5a6776986db6140c5a960a3360f5e901895541e15156cc340abc9d52335a5d12e26ca83d30e303aa5f2946d136360087be808b52e197ab563d311b5c6cae3d3

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
304c44288907b8094a1ccbb5fb7327ca

SHA1
c248df6f1696a9b5b8b174b5b955893eeebf39c2

SHA256
2f9d84517529ab263aa85dc933cb4b991898892f11c25d0032414da44cfc0f38

SHA512
1c3014b197b3ec13e55fcc24a0a450087cc5f034cafef900a359c90d5d51f7e41774b12f1367d422cb6ad82a190e5bc575c2e2431929e64b435aec794e3e1956

Download Submit
memory/1488-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1488-1790-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads