6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
Size

71KB
MD5

7195c47c46bb1a24e4f67a5ae9a02680
SHA1

bdbf47ddcdaa39e6dbdf2a50976f9474866b454a
SHA256

6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7
SHA512

24015c9b6bf2d6eb8f4356b062de96a4ef27368a9772a854e1abbc535294eb693aec8d5013c681f0a766392c8b9153c7430ae2fc82bd6143b57ab71316b1234e
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZBX5WX5tWIWY:+nyi4MefY

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2128-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x00060000000233d6-2.dat	upx
behavioral2/files/0x0008000000022aad-6.dat	upx
behavioral2/memory/2128-1942-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClient.resources.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\LockRedo.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\JAWTAccessBridge-64.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ppd.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.VBS.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Forms.Design.resources.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ppd.xrm-ms.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6f0b14e4e918bbe702a7d754e5eb4fa3c9ca8858a52abed18d20cf34b4cfd3f7_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp

Filesize
71KB

MD5
30571ba206274d7e248f008231e7a285

SHA1
42c25a28d7c224ed68ac30958d1e1c7fbd91d295

SHA256
56dea87fe83d793ba1748a5c469242d635923185d63d3ae20f000db1fad66f5a

SHA512
0a526dba7e4e96346374ecfb6ae187646fabbed2b408d0177a76465d3ac4d607e0472b4b6b9ab8ae599c262da9f83d88c239703ac03afa2c67e0598c750da13b

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
72eb0231ff0e5b72d9b47228b68432e2

SHA1
b30c731c4fc13e63cd9180abe2d77bb085dc216e

SHA256
844a1cc8481446aaab79f9add9e585e66ff31725717ff38324333496f84054ce

SHA512
6fc0971c7d5b28f8be6d98df4f52a9fda7ee140c323be5a1ce766419fcf21a5b444a9eedda733da0c832b332c7752f01a158397dc681cbcde7e18ab6a8978415

Download Submit
memory/2128-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2128-1942-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads