ad8f8440af061d69f3255800a6612486d63e7bd9d1942fc310b5e4dc5b9cb4ad

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
Size 358KB
Sample240611-qhdwfaydmk
SHA256 ad8f8440af061d69f3255800a6612486d63e7bd9d1942fc310b5e4dc5b9cb4ad
MD5 360346af00f7299b07e11aeb499de540
SHA1 813209839c9a8ea6d8e629b545be64371547a336
SHA512 c3a63757bfb43182808e2054b72927051e6da000bc91ecddb372d53413d34611f76079306403ded1a38da78c99a5342b16ce83d4c9e3bd994558d67bf50a9d18
SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIujQSo1EZGtKgZGtK/CAIuZAIuC:VQtyZGtKgZGtK/CAIuZAIujQtyZGtKgb
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4351) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4196-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023540-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/4196-1472-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Json.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-pl.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_200_percent.pak.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\C2R64.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp	360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\360346af00f7299b07e11aeb499de540_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
1⤵
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 359KB
SHA256 3e65791984a757ef7af6d556f1d7e014f87fd3e566ccf798c9e786085b8650c0
MD5 e2b7dcd9f0419a8829a88e486f29bb30
SHA1 53f23932690e8f0e7b81f6edeac2821d7d0322cf
SHA512 4a8e961ccf6f459c9fcebddb1445ec28f6ff77cb14b2b2d9e58c40d64cf2e257b17ab7eb431fa485b080ea4c2b0603a21b44882df520f2e973b8354a378d3108
SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIujQSo1EZGtKgZGtK/CAIuZAIuk:VQtyZGtKgZGtK/CAIuZAIujQtyZGtKg1
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 471KB
SHA256 a952a41c0e6f6aa15b795eafba8bdfbf254db6dc9e00a8f815864fac462e89a5
MD5 a7f32fa41bd07832a2e16716cca88e7a
SHA1 851c7e242b8be4d2327212d9f1dfabbad0ee4f8a
SHA512 e8553424995eda0ded789236438eeb350eed46de056523b4e9fc6c627580fbe05e5f64411a1c6189e9de1b7fc3f5e852fbbae6c05a0da3f900a75461c21783f2
SSDEEP 12288:VQtyZGtKgZGtK/CAIuZAIujQtyZGtKgZGtK/CAIuZAIuBJ3a6ZHcVar04I:VIt+ItCqxKPI
MD5 SHA1 SHA512 SSDEEP