b229f1218fc45a55a96334839d3e85bdf32fa0c3daf34569f8e8d12392270bbd

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 06:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
Size 87KB
Sample240616-g9k96ashld
SHA256 b229f1218fc45a55a96334839d3e85bdf32fa0c3daf34569f8e8d12392270bbd
MD5 dcf203d63b5fa49dfd5039830dab9c00
SHA1 0e5042423e80e1382c6542ee0b3db6910b6a253f
SHA512 46dec8f050465b02f5d5ab99b490353b6121d6bfbeba66e52e55906e4b638d4380cd523b0dc87dff274044ded82021aa54387735383c8a2d2213cf147ce2df4d
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJ6:+nyiQSoU
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1084-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00090000000235d8-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/1084-1954-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\WindowsFormsIntegration.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ppd.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pl\msipc.dll.mui.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemCore.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Luna.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.TypeExtensions.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RIntLoc.en-us.16.msi.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmux.x-none.msi.16.x-none.tree.dat.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSF.DLL.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dcf203d63b5fa49dfd5039830dab9c00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 88KB
SHA256 137bcef846abdab9822f144fc543d0e9240d685fc8a721d5a249f0d72826a2c2
MD5 a64f05a834cfedaa552955914fa95541
SHA1 7411ceecaaa1b21fccb533cc58f34f8ed4fa9609
SHA512 badb4e8c114fef783c8ecd1665e15203693abfc6fc387190a1c26f8462a293b7a4e6df3cfdc3c84766f0fbd8974b83881ac41e42ab21e31f43c9a4f5e4eba7dd
SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJJ:+nyiQSoz
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 200KB
SHA256 178c283f479485c6d61cb83d1a99a158cdda64c87e9dff10fc7b7045f8471adc
MD5 7a2c05a5bcecae09e63361959011dcba
SHA1 4017fafbc3c8364a087835e086b679533b2ed8e3
SHA512 5c87d097f5c472a22e1b31a9c41f8544ee82c5fe8f92fd9a248b9227076db1f6863ec15540a2e8cb6513eb733814e4073d4d0691b27dd9ce796f103dc949c335
SSDEEP 3072:+nyiQSo6J3a3LXGNCD/YFkedcTbvNJcr6O/Q4RP6:JiQSo6J3a3LXGZkUcTb1JcrjQ4Y
MD5 SHA1 SHA512 SSDEEP