cf206c9b03329189b086877290b06bb4dfc49c9fb639a66a58ddcf6ffa7c2afd

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
Size

198KB
MD5

2fbd757b752a1868fc1055921bec26e0
SHA1

9419329138817ab43210ef072378db5722a241f1
SHA256

cf206c9b03329189b086877290b06bb4dfc49c9fb639a66a58ddcf6ffa7c2afd
SHA512

0c37bd9fdb0a2241ef9053aa433a8e3c8ecb8a20ecf3207d8ca96852ef0e4bce31faf118b8e2555aa0fa8655dd98892fb3799ba0783550d476e69a7e7f7ff0d3
SSDEEP

3072:fnymCAIuZAIuYSMjoqtMHfhflixivKtjXZfHg9flZo:KmCAIuZAIuDMVtM/cjBHg9f3o

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3145) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2940-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000d000000012324-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2940-538-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.core_5.5.0.165303.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\Minesweeper.exe.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Windows.Presentation.resources.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\sawindbg.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\common.js.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libshm_plugin.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fiji.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace2.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\More Games\en-US\MoreGames.dll.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-6.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tegucigalpa.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\BlockLimit.tmp.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fbd757b752a1868fc1055921bec26e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
198KB

MD5
16ba653f1b3d12745c4708e82a84538d

SHA1
4777f3679a60d773cfb6d987290acdc7e3c7ca70

SHA256
5af9f8b5acc3bc23c76b230cb37e29fa80d948598e632ef3a4a1c67304417386

SHA512
f3363b76677ae947fa0818c1d5699e50972c3cd048ecd6960f4337811fad78b29b3544a1bc735678945167e24c362d50a34b9aedde8a2644ac85f0e0a29609c6

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
207KB

MD5
2c111c7c9f50c40f422c4140daf41f5b

SHA1
38c41ec47c41178e4a7c599c96cc86a3bc5e49b6

SHA256
184e3873116751f41c6e2be57f7bd61605003cf8a3c506126d50e4ca061af532

SHA512
86ff6bc79037054d3f3617b2d07ac115e4fdfbf626ecb6816521bfbbba7e8fc5a860e4bf8f8913543c5d547506dedf4e23d4d685899eaa0c0e36d359d1890e15

Download Submit
memory/2940-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2940-538-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads