35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
Size

51KB
MD5

c30fc3b644f6de9771c18d730e63afc0
SHA1

132f241ccc2962a28226d765acd4dff6a5d31de7
SHA256

35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d
SHA512

e05d2e3a6de8be372a80028757318fc8aec497efdd85a752363f0ada271773e7d4aca88e12200a716ca2aec707e178bad77735e73b598e3a331c44ab9b7e35a6
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzA:CTWn1++PJHJXA/OsIZfzc3/Q8zxL10

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5166) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3408-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/3408-1126-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Royale.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CASHREG.WAV.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\w2k_lsa_auth.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul.xrm-ms.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\35508ff9ae3c7550e54d86b5298e21ea5701945d8090f5d285eea789cf96221d_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3408

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
51KB

MD5
3de9ecea3c9aeb096b1ead39e958dc51

SHA1
cd4f603f00c9dce4fe50e3eece51e82e708817e4

SHA256
0caf3fb7f747d185d3c3ed5a36ce658319dc1430693f2426138129e99ee4c17d

SHA512
4e9c0051ffdeba0dd5c1274746937fb42fec945ca07bf14ba6b507c4d74bcc044f69bedc19c52d3426de99060c924fb37747d9d6c8584e8c073f5eea288dbc90

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
150KB

MD5
ad52360f59f94ecced77e8eabcb0f977

SHA1
f3cdfc0f96df1ec88bf368ba467126d09507298a

SHA256
09de4e101fbc8a1eb984777accb46e0c3d5837150309898143cf9e340f9f2bfd

SHA512
5b8fdf6d6d2f901c77484262c86cc962088d73ee901cff40a0f50e1934be3c5a3fbc3e1f0ee074e0dbe5a3ad9664e091a9cc1ca1d13ebe2903d9c5e2081ec703

Download Submit
memory/3408-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3408-1126-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download