36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
Size

57KB
MD5

a3a2ea9c60c25a8f8ae5426643962bb0
SHA1

dc26bd0395b6a1f9dca32297245896b6b9303989
SHA256

36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141
SHA512

d18e1e935f478ea9f09e5910568d79ecc7ce83bf791c6804c02a2233a5478ef0a6753bb4d909909fcd8a96a8e9ba8cc34c725e07c0620e89fc99da3a9c153724
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zx5858oga:KQSoo858oga

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1860-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000700000001211e-2.dat	upx
behavioral1/files/0x000200000001048e-6.dat	upx
behavioral1/memory/1860-80-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vincennes.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\F12Tools.dll.mui.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\vlc.mo.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-impl.xml.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\msdbg2.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search.api.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libmmdevice_plugin.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmarq_plugin.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\pack200.exe.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jayapura.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-charts.jar.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Manila.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UTC.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\init.js.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\37.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36358619d6d10332b11af45462311763ee893e495ce35b68843353d261b6b141_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
58KB

MD5
82765dd531f70df3a3a29553e6e31e0d

SHA1
2b229bcb54778844f364ab6b6c35c4bcd94ee538

SHA256
1eceb67e10416b0649e6ef610310b71fe3a187582f39e61658a73c0da6f587d8

SHA512
0e084fb16c27d74f6192020ce30e26925a1e48ece5f27ac89dc1fe8731f76e0e88fcb50b73eb82819bf92f76b8478f692043a675cfcfd5c88afa3c9ed3956544

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
67KB

MD5
8c6da9a793803c5a5ea8b350f49b2c98

SHA1
51997bfdc1b66ad89eec31b5c7a82af30ec9b0e6

SHA256
1545a663b540dd715ede8ca012e8bfb56eb5bf711dd933834f8ee03ac26a2f2e

SHA512
270febb8077b4f3fe4c414a9b385a927890d64f2a4855dbc96558e72ba5272bc2ff93497a1806c702a7894aabf5242e5597815c9f36b6eec12d74ad757755cd3

Download Submit
memory/1860-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1860-80-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads