5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
Size

94KB
MD5

ac8a5bbdaab42c360a25af37feb28d10
SHA1

5596760ed3796ee3d57382e9adf82945ccc7340f
SHA256

5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d
SHA512

2b32a90506d77cfe41e215dba0e00c81610b01b378e800706bc02a8074dcbf9a6676e93efbe6166d55a03653bffc0b4eae8aac43cec11d666e9d958ecb5e4666
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxn:fnyiQSoO

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5006) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0009000000023679-2.dat	upx
behavioral2/files/0x00090000000168c1-6.dat	upx
behavioral2/memory/4492-1790-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Types.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationProvider.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bci.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ul.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-100.png.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationTypes.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Xaml.resources.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-pl.xrm-ms.tmp	5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5aaf1e51e37eb8b5179f63b9f71daefc150a7beab98aec37ed439bdebe5b288d_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4720,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
1⤵
PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

Filesize
94KB

MD5
dcbba6deb22e4fb13affedf6768937ef

SHA1
33887717d164e4139d04c0cf7ca471fa3de564fd

SHA256
1f4774ca59c749c027f8025138824702ccb2c1930b6131fceb7cad0349d6bf13

SHA512
84c4e073ce1d1594d8e71265aad7c291e4028d1f1d4f01eeb2b1d4dcd82f42bab11c8ded423d0b1d84e83dbfb7d9d897204d211eac01f50ef47287f25b536598

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
207KB

MD5
2a65de7b4771de1bd0f226490734d449

SHA1
7ad3aca546cb1315150958062b191757f0335994

SHA256
ecda5216cf5213f530550c4ec98dab031e75a6c21235347557d0665c73dba88c

SHA512
8e3ca7ce3de83197647e000e38bfbd82b090aa6709255e67fc9b0b08a704c48ef5217c32e9cbf3603ec8cdc5f20d87d882d227577ac3efcdef448db04d530f84

Download Submit
memory/4492-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4492-1790-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads