d87478db8cf5ba0186f7beb146d86015c313108db0bb96823e45d662b1c957fd

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
Size 86KB
Sample240616-cabt8avbqa
SHA256 d87478db8cf5ba0186f7beb146d86015c313108db0bb96823e45d662b1c957fd
MD5 cb654b3b7c359e54b5d8b3817d1daf70
SHA1 dddb44dcd58fc65fa95cf6a9ad6755f80a49f877
SHA512 feab085cf7e30e66850ab678c3ad7f9e37561aa0df175fa5d41fed7fec681f1002771672142b6a19762c2d2197e346315819d60950bfb1a33f8a93926d4a7f2c
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8YiYio:fnyiQSohsUsxe+erZs1o8k1o8YiYio
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0009000000023669-2.dat	upx
behavioral2/memory/1428-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000168c1-6.dat	upx
behavioral2/memory/1428-1810-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClient.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\java.policy.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ppd.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\US_export_policy.jar.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsBase.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.access.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr.jar.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cb654b3b7c359e54b5d8b3817d1daf70_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,15316930299780304231,7592852768794498680,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
1⤵
PID:2588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp
Size 86KB
SHA256 8b23f7bddf6857477089f68138d81f3a200cd5ca3acda3996694c575560b6133
MD5 94fd4f05aab21e55c4898bb561b77ae1
SHA1 9bbc96e283ec2fb6ae2888bab6015baf3863a1f1
SHA512 9ec8ae332cc5342c0b8157090f4fb9f6cb013763c693d719a509bad90892d6bfef05311c6cfc244810d31e47ec21b7af88bad3d282eb50d940269452e9e77401
SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8YiYiV:fnyiQSohsUsxe+erZs1o8k1o8YiYiV
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 198KB
SHA256 265d3df35cf41e12f388b13a8c0abe6a8621f8ebb35930a593c0854bbc3752a3
MD5 83decc4ae181e07c61ea5393bfdd1cca
SHA1 8a947cf2ead72d5ddda4c34e82dcf00d5fb4d889
SHA512 7310e40dba73387f992fc06d4a3322d4a84b0afa101e061789942a666a43d24b4da62a9d0f0fb30c0f5fbaeb9e669cfbf51be98d1652935fc821875900f710c6
SSDEEP 6144:KiQSohsUsxe+ebz3J3a3LXGZkUcTb1JcrjQ43:VQthsUsEJ3a6ZHcVar043
MD5 SHA1 SHA512 SSDEEP