0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
Size

60KB
MD5

703136979b77c37cd3f7f13308c7c550
SHA1

fa6dfe50339d2877dd9189a4c51241b1e80e61b2
SHA256

0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06
SHA512

d24ae2062e5f40dabd1581d3c564404bb246d47edc5355e40f839ae6ba4ceb72d63f8a8359c5c5933b2813cc20648e7400b9ba9cce07ee8a60283b7a3f648861
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8Q8/8RYlaaGaa2:KQSoskRYr

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3672-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x00090000000235ad-2.dat	upx
behavioral2/files/0x00060000000168ae-6.dat	upx
behavioral2/memory/3672-936-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ValueTuple.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ul-oob.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-pl.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-140.png.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-pl.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ChakraCore.Debugger.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ppd.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Resources.Extensions.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\th.pak.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART14.BDR.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0ce3b91eb7e59fe394a84c7b9abc6a760ba0d0748c471b901e25fb9870133f06_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4212,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:2668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
61KB

MD5
e1b64f19a074b9785294928a4e009138

SHA1
45b287f3cf30ab04057cbd5942291985293c3ef4

SHA256
e3dd45a782904ae2ef64471f9ebe9778514e854e4bd94ed7227e081baee3a076

SHA512
3d1b19f923e6f8b45562cba4ceffccbb801a2b7e4a85c41099c68c6792d60b76108c1af606a4434644dfa450b3ce2bf82d19e214187c8e558e544a51aceab230

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
173KB

MD5
42ae8339ba29213ded0877bb7506c234

SHA1
2e265d75571d0ad3410737a4d7f87fcd2f010bc3

SHA256
24863e8808549baa49086ff475b9de39099c3ede4448f5a1add41d5668a8e6a6

SHA512
285e1677c41c5d3be9473ac14ff81031dc2f58949ba6982f9c4c290d64024eac9c8f621e601fe5557781396a5c4e5d44abd0d663fcd04ba6b2b76257a8ec9e12

Download Submit
memory/3672-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3672-936-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads