32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
Size

54KB
MD5

0ca32ed11cde1b8e6f565b0374c965d0
SHA1

0e51d6816d6f24b0f3323fce4c7df63287d07c3d
SHA256

32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f
SHA512

235e53594d898802cba7da3fb245abf56fc241d7e6fc12ed0028a1ee565ed643f2f1403e129adcb17dc99a2327f55189316728e8f29caabd7c0cd9c815372cce
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8zxZfxRfxe:KQSoWf7fs

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3606) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2896-78-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\liveleak.luac.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssui.dll.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\weather.css.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\firefox.cfg.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\picturePuzzle.js.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Seoul.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_150.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\vlc.mo.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IpsMigrationPlugin.dll.mui.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bg.txt.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.tmp	32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\32ae8d3100796bf5e2ea2994cd344737b9f7d7af7bd22500b572c7fa3e30bd4f_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2896

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
Filesize
54KB

MD5
5119418c4246b783edaed7cf9019dc2e

SHA1
5951a704789a4e25dcddfebe9df7ae1d983f3f81

SHA256
21e95c81399ca112e30be46709f856368627034bc8df2d2a5d5d2b7d0b76c64c

SHA512
3b113ca16c7de898d0c9dbe7d21885452fcd5b5fb43854510dec5fa3f80419d1306486ed0c38da3d9c39240a5e54d7db4490b93d341eed1847ae1a97fdf28c77

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
63KB

MD5
947bb84d39b0841aec4d99f537a1cdc1

SHA1
39e272fb3134644bd673b783dddd233a13a91e29

SHA256
b08ef92f53128250a54c693bc26012a9135e4a7af3a850bbd5a34d1f61711c64

SHA512
d256983c89a8a8762d7b452d9e8d6d1d92958fd56ba28290749c7da8f28d4fff6935e79c8285f634d676d2568a257b6be20ce4e2f9f5a34cb0945c3681228673

Download Submit
memory/2896-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2896-78-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download