0ad7cebb2fa159043b49ded59ed558342acbf270f57edaab12609c189983e8cd

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
Size 68KB
Sample240613-np187swhrb
SHA256 0ad7cebb2fa159043b49ded59ed558342acbf270f57edaab12609c189983e8cd
MD5 788e7c1e7681319d91bc2089f95dd0a0
SHA1 9da76acd3588d1a504d808411e0baa215969f8cf
SHA512 9b4493337f5757d0a2edb975486e01f0347b28df77c5902af7c48f31ff7e5a2bbb0cb87fb30d0fee0cab7771b7c8d5bca8e127c9ea779b1869d4a3d692aeccf3
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8a:fnyiQSox
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5243) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3728-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023595-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/3728-1962-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SFBAPPSDK.DLL.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Numerics.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Primitives.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-phn.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Primitives.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected]	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-oob.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\MergeRemove.lock.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcr120.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-file-l2-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.VisualElementsManifest.xml.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoCanary.png.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-pl.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\788e7c1e7681319d91bc2089f95dd0a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4240,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
1⤵
PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 68KB
SHA256 b1316bb3f9c7d31c029691b62e0eb4d4fcf7a9381735e9260a338f8f68676a53
MD5 4e736e1945d3e15d8bafd17f55b37b2b
SHA1 d65ee15864bab4aef81865194e697dc85919252a
SHA512 3b6090249337c8ec032971b655faa8f1d1b2d99b63ae4cd5d970fface5c65d41265c87b7a27b3378d556f54cd94595ddbdef2951f40668180d87ebcf98f365dd
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q80:fnyiQSob
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 181KB
SHA256 8798ce0a16bd051d05ec34d9880ae07a22b5bd0ec18aa8f4e471ebc5beb0dfc2
MD5 b544d0f1cd82eeb4ba1a52076895335d
SHA1 d35dbecb773cce7efd740da45cea2d70aa8c1653
SHA512 05956d545a0b9a75ac18afdd8f73b3ef91ab94f8bd80faaf523ca2a8d1232e47db332ad4f88a3a9e62fee72f5c444fdf422251e7baadc5f5c7f75c76fa304f54
SSDEEP 3072:fnyiQSo+J3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPh:KiQSo+J3a3LXGZkUcTb1JcrjQ4f
MD5 SHA1 SHA512 SSDEEP