97eb4f1a288cf31191209b2620bff49440256a1b78781ad4eb381bf80efff3cf

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
Size 58KB
Sample240612-hhxpjstblk
SHA256 97eb4f1a288cf31191209b2620bff49440256a1b78781ad4eb381bf80efff3cf
MD5 25758ae4db602c65a057f9c25c398c50
SHA1 6af5bd5732851f60d0b51e91ff2fc349bfe259e6
SHA512 1cc3f948e1be9bc9cba26db5c50980e7de3d817a813583356221045cf92c77b53ae396acfea15e9dd1d062be79131018c8b95c44893a08ff4e485870a6c491b9
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8o:KQSohsUsxe+erZs1o8k1o8o
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5345) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3780-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x0009000000023546-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/3780-1218-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-pl.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.NetFX35.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAME.DLL.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\LICENSE.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUB.TTF.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-pl.xrm-ms.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOSBI.TTF.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp	25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25758ae4db602c65a057f9c25c398c50_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 59KB
SHA256 2f71b40523824637e33d2b5fddca489f11e56154cd162873a5c5d60c0ec9cf63
MD5 abbbdff6d5a1486612766e398d384a63
SHA1 819feca5715bfa339ecad6d19e0ff3ba0a04ece5
SHA512 74e42ede402f6aa7ed5a8b2ecb155323ddbb9dcea9d90e5a1022592654896b210eedbc8aad9a152d386787fea128efb609c806efcc1c2f713412f2bfb23f3b0f
SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8W:KQSohsUsxe+erZs1o8k1o8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 171KB
SHA256 e66226672eb6ce02e6815b24b76ad5587e1a37a55e4372b979fffab80ee61742
MD5 5bec72db68b3c51bcd41e791efbca4c9
SHA1 968bf60485717c592b91d71c68e3baafd5b6b9ce
SHA512 89cf8ea2497fbec75a616ed14de243abd82945e1ff6cd27d6af35c309e06cd790b306abcd7410f6d6a1e3bc5cd04d79e3b3cf2db063b4ce47c5332d7d8120814
SSDEEP 3072:KQSohsUsxe+erZs1o8k1o83J3a3LXGNCD/YFkedcTbvNJcr6O/Q4RP+:KQSohsUsxe+efJ3a3LXGZkUcTb1JcrjA
MD5 SHA1 SHA512 SSDEEP