6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
Size

71KB
MD5

7195c47c46bb1a24e4f67a5ae9a02680
SHA1

bdbf47ddcdaa39e6dbdf2a50976f9474866b454a
SHA256

6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7
SHA512

24015c9b6bf2d6eb8f4356b062de96a4ef27368a9772a854e1abbc535294eb693aec8d5013c681f0a766392c8b9153c7430ae2fc82bd6143b57ab71316b1234e
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZBX5WX5tWIWY:+nyi4MefY

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1265) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000012294-2.dat	upx
behavioral1/files/0x000200000001047e-6.dat	upx
behavioral1/memory/2228-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\cloud_Thumbnail.bmp.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\sqmapi.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\JdbcOdbc.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Faroe.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Metlakatla.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh88.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrespsh.dat.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\Common.fxh.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-39690363-730359138-1046745555-1000\desktop.ini.tmp

Filesize
71KB

MD5
53180a9526a48e48a93ac70fe945e1c9

SHA1
9e0deef6dbe8f8158bb3ec39fbfb1e8851475db7

SHA256
650ecf24c0fe185caa7043c5791621293a6472bb76cc23b292b670e219d8e88d

SHA512
e7c25bd3ecbce1184074b595c264f3fbb71069709ca50464411bfbcaffcbba16068082f1056e70334fa035c09dbf0baf3a9e70d9c7d0be4f1b545eab02fc5318

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
80KB

MD5
fbe460b4ae2917f56563c10d7460e024

SHA1
8a66b3f643f695083cf2d2f61eb20d4d52a60af8

SHA256
5433773e2e4307b07796d873247ad5ecf4dbc025ad68607643a52335f30dc39f

SHA512
1814864c686ade62022ff7b886b5606dc8094cededdd70919b9310fde42d4412c932bcd437e6843c25b66ef0d212c1f682405bb65271342426c6d0733c119cca

Download Submit
memory/2228-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2228-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads