65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
Size

45KB
MD5

77c6bdc0add37572fdab4c9609672180
SHA1

8b7e70708a5cf74536b446a82bb3753b28a5a961
SHA256

65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281
SHA512

0e8809a81b2b07c7bc86396f0cc6e1c3e0c64473c308a6f3110b4d94c1cec8f022e1e2c2728d4af980281e212e849cb78840337ad875e658d55fc2dddac66a85
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAF6D:CTWn1++PJHJXA/OsIZfzc3/Q8i

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4049) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/1924-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvc1_plugin.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\PREVIEW.GIF.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Helsinki.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglinterop_dxva2_plugin.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\CASCADE.ELM.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\PREVIEW.GIF.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_ja_4.4.0.v20140623020002.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\NOTICE.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\ja-JP\MSPVWCTL.DLL.mui.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\PREVIEW.GIF.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\THMBNAIL.PNG.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Shanghai.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\config.ini.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\eula.dll.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\65a1e9e361bce05197f5425e581fb19f5c4243eec06f1d6f129df1e225906281_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
45KB

MD5
1b2fbc6e7d7efc0b7a9b11e80de78c4e

SHA1
dc782cfa55239cfecdf8fa3aab8b843f72dbee92

SHA256
3dd9b87d8962fb1b3dcf6d94aca2eed259958575313c973fa296fa885e0a623a

SHA512
75fdb9447e5a10ae751361d984c4c0b7430211209a1c4608dc07cdcdaf5cea63aee93e9a6e3d88fd4c5624714b0d83f4344a0a288bc3e7f16ef4dd22d763e0b3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
54KB

MD5
9a51a7d9982bd9cc7f8aa1c956cd5ba2

SHA1
89fc4c88321a0264845ae4af4aa953768a2e9b6d

SHA256
4c079162d289936ac160909daf082e973a73b1edbe3888e18bace4f8ee3aabab

SHA512
b8ba861847c21714c58821688d8cf11443ebfe7d64fbdd4b24e7ef6a64468bca5ad19cad99cb2b1799b34a8271f6392744ed6441524ba976cb1d3334a4182ba4

Download Submit
memory/1924-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1924-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads