04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
Size

511KB
MD5

748cc61e80e2469bd066b343b9bd2e50
SHA1

83280ff753cdaeefdf44ebc263273c34aeedea25
SHA256

04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0
SHA512

4d42e07d2a09c1ceccd98b20cbccde9a6273c2a0494a257e5eb16ae055067edced2c827a8812633243af6b87ec7277f16165006976e4fc7076c3f5f794bf06eb
SSDEEP

12288:VQtny10md3/94A2p8GnqZycIr+VtKzv46OgRhKB0OrJg:VIny1x/WnSyhbzvZOqU1e

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2143) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2040-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b00000001224f-2.dat	upx
behavioral1/files/0x00020000000106dd-6.dat	upx
behavioral1/memory/2040-322-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\glass.dll.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\15x15dot.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\libxml2.dll.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\bundles.info.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin_2.0.100.v20131209-2144.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
File created	C:\Program Files\CompressInitialize.xla.tmp	04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04450cf2bdf669d1500da1631056e3d60da59f9602be72cad9d95513407a17e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
511KB

MD5
9f8e27ea521af6cfcc5fa5140cf3d06f

SHA1
00eed84130c521c4644e8c8ac95bb5add2b4c6d3

SHA256
176e928bb689a067e793d6840ff409f5f2302c50efc1cd51c85270c9013dd2c2

SHA512
8e0602043319eebc3fda13ece5024be905b3f7d140bb27b686167561faaadc7c66207a563f559d0e925ddfbbaaff03e3cee808b8efa8772f2d91f74781932729

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
520KB

MD5
7dfd8e7770533fa4950ae6fd12f6d23d

SHA1
ac86c6f4f3aa31622f19c3f8145f1fa38dd72aaf

SHA256
0f2edd7e0f6324cc3215d0182a4638b6263272403b36f5543b023ea7b4065516

SHA512
bada36f09ac9813bbaeab0697c2d2e86e39cec1e2d8a6bc343346c035284f233baedc56da989531813bbc1de97db417c126b2b8c05e5257e514e5bc7b64ee44f

Download Submit
memory/2040-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2040-322-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads