86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29/06/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
Size

51KB
MD5

61f37200af868d8f2f82d2414a245a70
SHA1

9111a67144ad89348cf88cc121afd348c63fc45a
SHA256

86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148
SHA512

f6625e5cef1df34f8fe2221f74ad010f939dc2cfe49edd86bf8abea7224408f81a897cd73fb4d3ac8db026cb244f34880bb6c6897c8a6fc214bfbd5d2601a924
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAF+l:CTWn1++PJHJXA/OsIZfzc3/Q8OySUi

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3818) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1644-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c0000000141a1-2.dat	upx
behavioral1/files/0x00020000000104db-6.dat	upx
behavioral1/memory/1644-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Adelaide.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\mip.exe.mui.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationBuildTasks.resources.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\vlc.mo.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEODTXT.DLL.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-modules-appui.xml.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\gadget.xml.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\it-IT\MSPVWCTL.DLL.mui.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\MpCommu.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\skchui.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yerevan.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Monterrey.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsFormsIntegration.resources.dll.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\localizedStrings.js.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css.tmp	86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86f27a6ba393e53c29dcc61e376a8f4d483e8b31e1a4813f5bc0576165ccb148_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
51KB

MD5
ebc1d2f07cab5d2233cbfa86ea985739

SHA1
8b29993a2e09392f93c0b8eedd66ec9f8543be94

SHA256
52853a6b7e6c97f708df6a068e30af116b0b733fb79dc2d9667d37d001989fcb

SHA512
051ad0a38be33ca8c2768ab6686acfe91f233b08b3d4a521191dd286ad4730e47798e27099a08635629bf5ccd357c591621aa62d28d09ea06bf4f5ec9c764ccc

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
a8606b0d0a8e5ade17c9fc49f83bafb2

SHA1
9b4a66ed24f576e86c4d6d88c1b7e866e6c7c08b

SHA256
ddd100883f64fbb38cb287b1bcba14bfe9aeab50486384057f50f95b4d9b66a9

SHA512
f8f13403520a0d65424969fa541866ebb3885471b0654716af2fca9e23f654faee6799b48b5d6592d63a4f844b467480c9ea20f6cb4c4b42061d38da66e74d27

Download Submit
memory/1644-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1644-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads