26670f778f0a294819f95d9d88157790aee4af2e707578263e4caa2c4267a4e5

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
Size

47KB
MD5

0176b1e4baa054261dec3b5fe1a57240
SHA1

f7de8c3939731cfbc7467d4aeeedc108c6a7bf43
SHA256

26670f778f0a294819f95d9d88157790aee4af2e707578263e4caa2c4267a4e5
SHA512

a5dee86c10194b03f29ed47c3c2b9089dd14c6c5008fcd67197cc2a423def28bb756f0162a7596577fa9e52608b1afa255c5dba994d143badad821d2c1ed2f56
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFMx:CTWn1++PJHJXA/OsIZfzc3/Q8MfFpsJW

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3507) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1676-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000d000000012327-2.dat	upx
behavioral1/files/0x000200000001048b-6.dat	upx
behavioral1/memory/1676-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_copy_plugin.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\soniccolorconverter.ax.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.aup.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.ssl_1.0.0.v20140827-1444.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\de-DE\msoeres.dll.mui.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\NBMapTIP.dll.mui.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.xml.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaSansRegular.ttf.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0176b1e4baa054261dec3b5fe1a57240_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
47KB

MD5
012067335744c5c9657c74213931153a

SHA1
8372a5ba66b5714419273cc9c2ff1e29820d0175

SHA256
278a2c1f023bc5584ac4ae5a0bac44ce8a97dd69ea761a368dbd5d6060cf4ccb

SHA512
414991abe0919878d02a20ffac01f4116d501d43dfc50c9e74567fa43dc4ac4f8ff8ccd4b97a756f479faba56b23e58fa24080bccf098ac93272f19a138de8da

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
eb7ee958131d8e4e51fa453a76ef65da

SHA1
f59ea2e03190325b22d107e82859ba5c71a6dc82

SHA256
bb6402bdfe03f3c3e51eb60c99a1143ef784cd2ccb9500c8a6a6b998643cf556

SHA512
297ec539fcb3b22f0c7bdf1455f3d477697056e8821791d630e7a2366d89cdfe529b4031de462f8d64fce87214b8a50aae0f77718a4ee3b28d990e985a2f8599

Download Submit
memory/1676-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1676-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads