8494da24887d215d9f7dae2825e801479b5a70fdc3e6ca76dccf8f0d875e8213

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
Size

228KB
MD5

4f15a074407c1438a885c3e7bc4e1bf0
SHA1

2efded8a3bad4203a51dc40973742648f4895fbb
SHA256

8494da24887d215d9f7dae2825e801479b5a70fdc3e6ca76dccf8f0d875e8213
SHA512

5f1345a54eac0d187c86a4215e29b9d5c6122a27b139454e499310dc123685b1c2449d2283a73677827a43de2382868fefc035edf44b31c7720624bef2676b4d
SSDEEP

3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuYch93g+gfFpsJOfFpsJL:JiQSo1EZGtKgZGtK/CAIuZAIuH3f

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4676) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4288-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023547-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/4288-1608-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-pl.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-ul-oob.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Permissions.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ul.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-pl.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-phn.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.Entry.Interfaces.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Extensions.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4f15a074407c1438a885c3e7bc4e1bf0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:3684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
228KB

MD5
b8d442ae575a4bc267ed9a405a895d0e

SHA1
898cb77c5acffb5c8857b0d5ae29139610529d23

SHA256
7c10a2f481e1bf0a0184527ee6865684647837fd5ed8c7e17d48b91df922c548

SHA512
bfd7688b3929560c77169bd0453d1eebaae8653e8102c6b58b99af4ec227e25e232586845a1bba38d7cc476e986b2f68529ccda22b40e9c35ffa16adf7f550ef

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
341KB

MD5
fe24106e28a5b552d7eb2ea943ccdded

SHA1
b4dbe6d136bf1820e3191d1600c2c586ef0e6b56

SHA256
281cdd0ea704a07b433cca7a36a14f6a3d9993a1ed70e04724e88be7d44fa63a

SHA512
58231dbf8009602177feef1116a85fd0efdb180ac0a93e75f4736afb14f326778d3f7af1b16916c1ea69d24253763bed906ad270e352e0953bc4a071ec08964d

Download Submit
memory/4288-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4288-1608-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads