18a7bd89a16b8dc9a287f6f7956af451a5982e88d2fe7e2b0e6e6c2407e5f902

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
Size 110KB
Sample240531-ajcf1age99
SHA256 18a7bd89a16b8dc9a287f6f7956af451a5982e88d2fe7e2b0e6e6c2407e5f902
MD5 6e90b3d99d17998961b9454343d2a830
SHA1 eb9e6ab0b05a4b5692a5618e0611e8f54eb5cde9
SHA512 e8c3d35f5213e789bd19143e32940d5e322f115b0a59a4b5c50ea11bccb38fc90915a57e90544e9e3225b2c7e4adc73bd7243a6829ef95a7d58169c404a14174
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsSTWn1++PJHJXA/OsIZfzc3/Q8asu:+nyiQSohsUs6QSohsUsi
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4812-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0005000000022975-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/4812-1832-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ul-oob.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe.manifest.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.ReaderWriter.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ppd.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-pl.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.AdHoc.Shell.Bootstrapper.xap.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lt.pak.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-pl.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\npt.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ppd.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-phn.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ppd.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jli.dll.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp	6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6e90b3d99d17998961b9454343d2a830_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4584,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 110KB
SHA256 d8d725f512bb1d6d31c3b70bf51c7b34b83c0a5af3678dd0b46522f761fb5bcc
MD5 0b51fd2a85ca6f07029327a681aa1918
SHA1 1dc8470c89e1fa9ee53a053626f828f1ec884f02
SHA512 0494df47e6976691b6d686e97159b99bd6cb242d15ab04be5220553c7ddc56cf4448d72f2eccecc4e9c5a7eeeaae01f054e7a72bd781bd60430d72e5ec91d767
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsSTWn1++PJHJXA/OsIZfzc3/Q8asz:+nyiQSohsUs6QSohsUsX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 222KB
SHA256 f3faf74037d5bf790bb556c8081fc892b0b8d9f446ac9ad0a0068f3f7306f590
MD5 3c961734bf5db2b80dabd05899f65c5f
SHA1 30a6108a2f1f832e207187944195988f09eb610d
SHA512 b9615bf07be5eacadc40a6c01c0057689f93e5e3961ce8c8fa48d273f468f5c1094e242bf84abe572eefdf4ff1691c993b883889df65dd29476a3cf47de8fdde
SSDEEP 6144:JiQSohsUs6QSohsUsyJ3a3LXGZkUcTb1JcrjQ43:AQthsUs6QthsUsyJ3a6ZHcVar043
MD5 SHA1 SHA512 SSDEEP