555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
Size

47KB
MD5

d4e095dad562f08869f8a4f1f8d07520
SHA1

c34f3ed163bc0d059d76cb37158926e08fe9fcea
SHA256

555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86
SHA512

98ee81d6459f7a25c1090b7086a15a5a77c3079f1dc9ab53c6b0185044ca6151c8362379d9746e8f33e7d26ce71ac92b4275d6ab17ccbcde7dfcea2ec6ac846f
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzU:CTWn1++PJHJXA/OsIZfzc3/Q8zx+

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3456) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000500000000b309-2.dat	upx
behavioral1/files/0x0003000000010440-6.dat	upx
behavioral1/memory/2120-74-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\imjplm.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblend_plugin.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_autodel_plugin.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Rainy_River.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\MpCmdRun.exe.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_ButtonGraphic.png.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security.win32.x86_64_1.0.100.v20130327-1442.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsepia_plugin.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmlaunch.exe.mui.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\555480da9888629b3e28f4417f41591f9859f929a769471e4186a0f97528eb86_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.tmp

Filesize
47KB

MD5
a51e7a56e874b0a16cefb7ae3c532817

SHA1
6c3b44cfab889ae7bbec7be97642f64d11456d5c

SHA256
c542ad966157e9151e18353506cb3e1fac3be32d1ff30d4c6700677820519c67

SHA512
27594dfbe4cb2763dddfeed2688db2a046d287cd111538e127a52c768f5589a3d4bc136331a51e791c266e24ecd7dd56365b8b1ff6348ca3e79032b932489732

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
56KB

MD5
dc3046122667b44964385d92c8238230

SHA1
02ebe7638cf4d4e9aa554143180da2d2b9377d24

SHA256
c5ee002461a651a63f39976d5fefe4df8eade99bddeccb93d6e2c0255fe0ed2e

SHA512
7e2bc790fd996659805d3b27db3cee832271f2082ed67c8e694edcae50739c084be3234eca0eabb0cc9ad4e8ab112f98d3121fa8e9176ecf7db1b2f5346364eb

Download Submit
memory/2120-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2120-74-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads