Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 06:34

General

  • Target

    5aa170c483a04ff636acb1e846938290_NeikiAnalytics.exe

  • Size

    73KB

  • MD5

    5aa170c483a04ff636acb1e846938290

  • SHA1

    9770d7a5cc7bc6da610d2700ae7287c3d3c4f75e

  • SHA256

    3b3b8c03dc75e294ee764a820f27447145410c894c0697fbb78ab986126b71c5

  • SHA512

    4eb80112f7bf078d09a5c3cafd717167354f73ace5e34b8007375655e30c7b193f1dbc6b549b8e7c935b1d6c9be8933546c14615504434d7be74c19f8bde775e

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8XJU:fnyiQSoUJU

Score
9/10

Malware Config

Signatures

  • Renames multiple (3440) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5aa170c483a04ff636acb1e846938290_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\5aa170c483a04ff636acb1e846938290_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1340930862-1405011213-2821322012-1000\desktop.ini.tmp

    Filesize

    73KB

    MD5

    ce62864b918b83b37bbc0269ceabe355

    SHA1

    fa8e59d12e477a069faca4a340708e3480e8946a

    SHA256

    fd5d14c1e8ca19be0e2fa30c7aaa987b50e3391256c95424f6501028720ebd80

    SHA512

    a0bf4a5187d05ce1b8857a8f87a0962cd12587b6df1748fac52c80246b576475d600438268500c43260f447c7a915c39655f54879d535869ddd6977382fd5534

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    82KB

    MD5

    cb7cad0cf4516ddedc4f990d031d925d

    SHA1

    bbc3ae5ebb3663f7cecbbd917865998cf8946f42

    SHA256

    79b6c7c40dc891745af7904504f3fe2929604c8023ec97157cde5001dea4f580

    SHA512

    799c9857882e833a744da189c0cdd8da732c8e783d85aea9bbeaff34691410df9418131c63b85db7cfdeed9d878f33110b9007eee06cc0ea37fc705474b9512d

  • memory/1752-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1752-638-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB