5c601f69c72912bdfd4ed2515a110dbe1ce56c2559643f5d43bfa975f7f0b9e2

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
Size

229KB
MD5

3f0961f350dd8cd2a5e29ab5c2031060
SHA1

a744cdfbbd1d0b3c8cea90c6cfa494e65dc85a47
SHA256

5c601f69c72912bdfd4ed2515a110dbe1ce56c2559643f5d43bfa975f7f0b9e2
SHA512

c630c88e3ecac346ac4ad1f386289c1e0ce88bea28b9e8e3fa7d440b7ac2f0da5a31b7ccc1573ba9ccaf6580314ef508c5684964a72d1d086db88cbd6d1b0911
SSDEEP

3072:+nyiQSo1EZGtKgZGtK/PgtU1wAIuZAIuYch93g+gfFpsJOfFpsJrB:JiQSo1EZGtKgZGtK/CAIuZAIuH3vB

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3095) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000e000000013420-2.dat	upx
behavioral1/files/0x0002000000010674-6.dat	upx
behavioral1/memory/2792-506-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belize.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\index.html.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_ja.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javaws.policy.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Tbilisi.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoCanary.png.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-1.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.ServiceModel.Resources.dll.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\LimitCompress.odp.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ndjamena.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig.tmp	3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3f0961f350dd8cd2a5e29ab5c2031060_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
229KB

MD5
256e0d9662802828b0311a94b963749e

SHA1
511c70a240386331067fecdffc0beaaefee17691

SHA256
c5fd1f10967909fcc361bbe53fde9bbb552c3619f180ea773a2d7c87201f137c

SHA512
91ff3b3b17c3556152b905d51bb2360128783179fae42b1303ceea5429d206bdfc99e74f63d1cddcd31964eeb250411a0b3ed86d6abee94177189d013fab18f9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
238KB

MD5
6276be40f23a9634c200fe4fa137f0d4

SHA1
7d6c327ba3635ef93977822683d5d90b0308db01

SHA256
a6f99ba09c0cc0ee3027c9260129da18b6e21b34bd6cc1fca7ff4ab496c33ef5

SHA512
296e8676b03cb65276bcf1442cb249b05521bc68db90122e87f209bc76744136e4ba2c549c9e080ce171a6f2ffb6aa926fb95e1673c12b70c8648251a535ed5d

Download Submit
memory/2792-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2792-506-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads