3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
Size

152KB
MD5

2659976856a829df4277003b1e602eb0
SHA1

39d97f7da482bcd7b52582922c1afd7c884884b3
SHA256

3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489
SHA512

4992701f6f5ffc82c715677ba4d236a54e834d004ccc135b014d35823a6e13d99abd7f61f5331a169065cda12e7a5e2f946117564368f5e4f99f71755b1fc3a4
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8NCub/maYIkbg+EtpYsQQ0KwOEbZ6qwFd:fnyiQSoDublmApwQ0KwOGEqw0G

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3408) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2140-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000500000000b309-2.dat	upx
behavioral1/files/0x0003000000010440-6.dat	upx
behavioral1/memory/2140-620-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\libxslt.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_zh_CN.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBlue.png.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_ja.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\pdm.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Printing.resources.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dt_shmem.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javafx.properties.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Guadalcanal.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsmf_plugin.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Singapore.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Majuro.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\WindowsFormsIntegration.resources.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dcpr.dll.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3468b3d947ec4e2fee77fb0de403fb494dd63b8d33fe847ef3a5fc79729f0489_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.tmp

Filesize
152KB

MD5
1500ea7d6435d410037af882319bfffd

SHA1
7f230182f445efc72f4178f547a72e4cff26cdd3

SHA256
92f3ab4a649e27c3cfa275cddc6baa6ed46d04a787f2aec5a4bd2d3e0d4db155

SHA512
a18e594a9eb7add49de3b2b21adb0f84c08d3ee57e5cfce5c721024868e5c3d8954c81d0b27cbcb962fa8832944236e83a6d51a7ff0c4adbee7f7e7deb51a503

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
161KB

MD5
2d01ac9b7b7302dca18b089a37ef0347

SHA1
12f071b14250dbab3688eaf79239c7cc74b0f7f8

SHA256
9880114eedf581bd6d665097be8376f7cce1fc64179bd4803c4f2d709f3221d6

SHA512
61acfe7a18f0ae51f9d31e7f9d8b32d9cbf2365e2c3d1f7f6a9fe8c2a7b2911cc71d72788e7ca690deaa7efa87d3e24b47101d1eee52123f060a4abca2709b73

Download Submit
memory/2140-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2140-620-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads