ecb2f0ea2da79f74bc2876f30a4c30e88023932f7c57983237304f8784bcb1de

Analysis

max time kernel
132s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 06:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
Size

43KB
MD5

46a6f0ce2a3f33c739e7ca5ad7091280
SHA1

5884e665667411c48ad309aa174d3cee0bf7469c
SHA256

ecb2f0ea2da79f74bc2876f30a4c30e88023932f7c57983237304f8784bcb1de
SHA512

442533e0da1c78a9b17db1c3e7fc7c9cbc4db70f02dee8cf2bc2b01e6a3b21ddfe4ebda01aa6fa9987aa516e4d789157504980ff72a00974afee69115786e1a9
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFQ3:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8SJM

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3442) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000a000000014af6-2.dat	upx
behavioral1/files/0x001c000000010439-6.dat	upx
behavioral1/memory/1936-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-tabcontrol_ja.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\MeasureUse.wpl.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\t2k.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_ja_4.4.0.v20140623020002.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Asuncion.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\vlc.mo.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Niue.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Vladivostok.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkWatson.exe.mui.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.tmp	46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\46a6f0ce2a3f33c739e7ca5ad7091280_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
43KB

MD5
88eca2e507b39deaf58cb7905f86b36f

SHA1
6dd36194a9500f5df1af20538e33d7730375b8b8

SHA256
f1d67853eb7313e4afed846a56d6224605940374f1f5a431987d4dbf4e7e4336

SHA512
ba440a62bcab0b149682a82dadc2bac90966f9bb5f0916d855332bb0d1b1ce1330557c2c469fae8b28d72deda0c0704d067f47e1b162a739e6285a70bff9f5f4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
52KB

MD5
dc6b0d651b6ac5a917d2e2cef49c1d18

SHA1
143c3e81f3d7fa6eb70078d93236d1cdadd84079

SHA256
c3d4ae3c946bb0ffe8469eb3d640139a63470142482695dbf78aef6ec331766f

SHA512
2bdb5c09715166bcc23493216adfaad42e7cbaee8341e2f7a9d4f861e77e1bad62b604ec48995094a558574349953a15d5dc8fe21e40cbe8a5903af1246e6c12

Download Submit
memory/1936-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1936-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads