1ab345fe9ab3463967ffcc785f0db1797502ce6862bcf6de59d857824a60c184

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 14:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
Size 703KB
Sample240611-rsgkrazerd
SHA256 1ab345fe9ab3463967ffcc785f0db1797502ce6862bcf6de59d857824a60c184
MD5 37f385cdb5eeecd89f2cb3782725f280
SHA1 76f6e9ffee210820515878e54c38cf5ff2738146
SHA512 29be0f43dbbfca9834d4d014a0ecc53d098159ae363e4dbd5a2e412ed5e7b93d52994a8e4dedffc9ec49e6dc34469e493d36349ef31ee400eaba002cf30eecea
SSDEEP 12288:VQtDnMwHskY7gjcjhVIEhqgM7bWvcsi6aVlXIyJgJGP9/ztLlAZHYL:VIjMysZgjS1hqgSC/izNfOJGlbhlAZ4L
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3168) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/60-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000235d8-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/60-1212-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\profile.jfc.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Primitives.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\ConnectUpdate.mht.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationUI.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\vcruntime140_cor3.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ul-oob.xrm-ms.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javafx_font.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\37f385cdb5eeecd89f2cb3782725f280_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
1⤵
PID:4320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 703KB
SHA256 0a3f849a662f06392a2159e14c986a5a6078c2e5448d2ff6eeb1c20f228f898e
MD5 dafdb46d07e642570a0a2aaa6ccd7e63
SHA1 299772eac4a8654a16392bdad8867aea51930cd3
SHA512 953b81191e743e1e2ecd28acf2208d987802aa7cd1c05f796b9068982188c3f1f63ff1c4338aa7c96b5dc7a4f3ca972282244a2fe5511985b96f59caf1d428da
SSDEEP 12288:VQtDnMwHskY7gjcjhVIEhqgM7bWvcsi6aVlXIyJgJGP9/ztLlAZHY0:VIjMysZgjS1hqgSC/izNfOJGlbhlAZ40
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 816KB
SHA256 3c500ed63b685e5d8fe9e33c0839a67471d243ccc40c50b41fb4a18734c9b937
MD5 098ab78d861faa214e14a98cd7c6c871
SHA1 a4fe598f667f80090daac0493aaae7155fda0427
SHA512 37a1b9b7332828ca97416c47f433e4e26c0453b917303274cb66e6094c3aa4c5affedd5de15628888ad93b2a110cf2852f26127f67f22977a07f8b5b98fd208c
SSDEEP 24576:VIjMysZgjS1hqgSC/izNfOJGlbhlAZ4vqxKPA:VKRjvQopgGHxqsA
MD5 SHA1 SHA512 SSDEEP