Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 08:26

General

  • Target

    6a29ac6fb7424377296e6485c8930000_NeikiAnalytics.exe

  • Size

    67KB

  • MD5

    6a29ac6fb7424377296e6485c8930000

  • SHA1

    9cd1a5ffd4a9a8fc92539faa369d095d16daa73e

  • SHA256

    9e56a1497231cda626066d47b7c54f468bbec41a5aa20f0a1d1103451dc61949

  • SHA512

    688e8b786016e5827ff52d83a68a5bd915e0a9243ab3a91119ceb4c73e6eab991233258cee713d9d1a619ae4475612a3d3a53e8e19d3cef04e5aec8db8578f3d

  • SSDEEP

    1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8j:fnyiQSoA

Score
9/10

Malware Config

Signatures

  • Renames multiple (986) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a29ac6fb7424377296e6485c8930000_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\6a29ac6fb7424377296e6485c8930000_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini.tmp

    Filesize

    68KB

    MD5

    9306abde150413ace451116b5f161ffd

    SHA1

    763fe5ea1044b09ce8513e7a8cf615777cbf4b47

    SHA256

    87ddbd5c45db798e665ac9bd2414b7988457bf180c03a995cfb096a76f573d7d

    SHA512

    906db5659bf0113271b3ca9675f7f49de0bc888bf50a0e02cd778bd74c7bbe1e74c4726c102e7a5493c7d6015303d005e5e16f0664fd6c6508c58def01d3e564

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    77KB

    MD5

    a7cc6f5fe59d5d0fc059449250f9843c

    SHA1

    829feb5bf9b8f526323877a66ce6f8261d1ce831

    SHA256

    87e40f47241cee1d5b7a8aa2e0da3c3ce9f94cbc817e6375ac8184e806114b7e

    SHA512

    56e624cc69f484bdda9e43ec46e3b98e88760e3449e21ea3e3505ec620dd15da20307e878a0a650302a8090cb668e45b4aa221f17ba247439729bb3ba055f666

  • memory/2140-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2140-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB