46e09f548420d3cadf6db4010d96ef83bee2ecd39a96c1b763e672c8907051ab

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
Size

94KB
MD5

31d404b461fa0f153b8ea4a215cee5c0
SHA1

2dc025fe5548e6a41a5d2483328585dc3a504895
SHA256

46e09f548420d3cadf6db4010d96ef83bee2ecd39a96c1b763e672c8907051ab
SHA512

7530f5c75d4ad13fd00cc37fb9ee20651684000645a43035309ba32f2941c9f27f0e69ffc14346779d962afbe8a241473c6ae0871e458fa8f928e4a6c4188426
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN5BV:6rWpcOPxPke+e3fFpsJOfFpsJbgEv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3471) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Anadyr.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Journal\ja-JP\PDIALOG.exe.mui.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cambridge_Bay.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgzm.exe.mui.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\MANIFEST.MF.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\vlc.mo.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libglwin32_plugin.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\es-ES\sbdrop.dll.mui.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\SendProtect.xht.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Media Player\wmpenc.exe.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar.tmp	31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\31d404b461fa0f153b8ea4a215cee5c0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:1924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
94KB

MD5
1fc20d71b01e839592e16b76ba094208

SHA1
97edf324aed69e34637dccc6960ec1c8ecd019f5

SHA256
1ffa84a0177c0fc2ae2cb63e74c13af48ec89d5aeaa280afbd0d6b2bc76d0545

SHA512
05ca5e201568cb62cda1c39ddf7d49ada38a5f2cdde1d755affe5eae4f4c708d5d6df60f6dba330cfd5de06ec68799f0831aeac2a6566b2bc7354eac46bab6c1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
103KB

MD5
dd63819e0f243f656cb5a302a59ab51f

SHA1
a754df1ff665f7b8e00a1d949e2d8e92a9b54a59

SHA256
44c27df7a6d4bff63dda47bc800fb35821c755c5d382256fa867cfc7884adaab

SHA512
36dd91b6c6f135149b73e4c66ea4b03c769ef87f62d860926616c40a88b9c160d1a17f7c711f9cf636af3d1f7b69393f3b730095138196e4f23e54edfa25ac9d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads