720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
Size

71KB
MD5

66fceea28f5ae1b00cc10ddc6166ac60
SHA1

9d7825e6842bc99cbf9ec96c577b75f4511770cc
SHA256

720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28
SHA512

2436ad97eced9a9e74bae4fcb2f1fd86f670b6d2e75222a158351e729d9ab9f75cca2576f787d49e35f48b1976cf66ac59e65bdfc80ce96c4d838cea6c127f2c
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8IZN:fnyiQSo7ZN

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3784) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3044-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000a000000012286-2.dat	upx
behavioral1/files/0x00020000000106a2-6.dat	upx
behavioral1/memory/3044-666-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ApproveHide.edrwx.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Creston.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\it-IT\Solitaire.exe.mui.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JAWTAccessBridge-64.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.DataSetExtensions.Resources.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9YDT.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libgme_plugin.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\ALRTINTL.DLL.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dt_socket.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfont.properties.ja.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\720442f709d6f05939c6054e51f657a63f6d86b59d8bc8f2474957b9ac1d7e28_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
71KB

MD5
50944f831f9fe5a779718fb19c22faf9

SHA1
2d61d762646e71f8c9295bfe455d5f70ff49709a

SHA256
b0bdbe7f112a7f0e4ec9fa4d49adb710a0fcad6c30a9701a3881cfdf995eb437

SHA512
a209d083b33a413ade6f95fd266cb97f94c2bf2aacbaaf3ad3704052e997fdbc73d2692986b890884d391d0da5c38154e19516b38cd3275be28df5b09db6eb65

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
80KB

MD5
a9dc90e88bcbb3982da6a18d684c0e9e

SHA1
f76bb4f28c4ea89ec0e5afe3df1cd80f18950af9

SHA256
d635cdcd40764eaaa15092b88a0baa06b700311fec4b2aa54abae1be8b8b80ac

SHA512
b402802a6cbb7d5497cfc4d5ce026cac70733c65c0ed94a0d75bdf97e92c61c6dea43f74605e1a59a3cb6ee370ce2c2a38409619f1e977c4516ea30ae80654c1

Download Submit
memory/3044-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3044-666-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads