7c6f47514f36e4b8407c0cd71684fc6af2747a262291a008d3b202695f97128e

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
Size 94KB
Sample240616-243bpswhrj
SHA256 7c6f47514f36e4b8407c0cd71684fc6af2747a262291a008d3b202695f97128e
MD5 1a15455eb60203138368cdbdac2d0000
SHA1 05cda3d4ba2dabd2c5951764ff3a16ae9664871c
SHA512 c6e8e6cc64e6a3f07d44ea5ed3ae0e2dcce4216c8953ac18ee7cee9020a06dcf1888e3f0028fa372f132321a21af2f67c2e14c2cea2e0705b2b1984a388cb160
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOP0:fnyiQSohsUs+0
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4848) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3908-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023671-2.dat	upx
behavioral2/files/0x00090000000168c1-6.dat	upx
behavioral2/memory/3908-1788-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QRYINT32.DLL.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\cs.pak.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\WindowsBase.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzdb.dat.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-profile-l1-1-0.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationProvider.resources.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\es-419.pak.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp	1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1a15455eb60203138368cdbdac2d0000_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:3756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp
Size 94KB
SHA256 706e83335ab011573ad6c42dce3a52c948285c48b85f67397f6ad8a7527312c1
MD5 41ef803ae0474a3f655043a23f094cd9
SHA1 f222789290dbb821c32f9c7f342064c96bcc755d
SHA512 99d376f404e2b2ad26be1d2eee4e19b7a53a9618009a2704a819d1bc7260425996b769c31716f516c8a8754bf17e40e7594c9b89f9c1434b295651930a229e06
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsJOPZ:fnyiQSohsUs+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 207KB
SHA256 dba2287c24afbe6f093caf9cda3715f22066bf742fb378d6d3bbf743c639206e
MD5 11be5489fb04b4293d532079dd089472
SHA1 49709c468029dfb3463c3f6412d287146ae54a09
SHA512 b1384b84936b9040384f95384999f07c3ca4ce7e8ddda90c15a1b7be3980a95f499e3a7e9b877ede085f2d576466edaae299419e8cc720cc927573697195832a
SSDEEP 3072:fnyiQSohsUs+EJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPu:KiQSohsUs+EJ3a3LXGZkUcTb1JcrjQ40
MD5 SHA1 SHA512 SSDEEP