46edb7e95fc88e60e50c413f4c324f05acbfedabcfc611d74ef1b75a5863a853

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
Size

74KB
MD5

7dcc62dcece8267ccc69ab0615477d30
SHA1

039e89c11c6d5429033edf6027c2801c99dd3b0a
SHA256

46edb7e95fc88e60e50c413f4c324f05acbfedabcfc611d74ef1b75a5863a853
SHA512

d7436cb99a0d1567f2c71985580d15d78ea5f80d3bc7beaa0e2bc6b988d8404d30c4a2eb54fe5a87a82a6321be3b0889c674de7fac4e47fd55ace677943a4d13
SSDEEP

768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJx:W7Z9pApQESOHepOHe8G+6E65TGAR9N

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_de_DE.jar.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_disabled.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Oslo.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Design.Resources.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoAcq.dll.mui.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\settings.js.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Resources.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Media Player\es-ES\setup_wm.exe.mui.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DisconnectReceive.ADT.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_SelectionSubpicture.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libdummy_plugin.dll.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\7dcc62dcece8267ccc69ab0615477d30_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
75KB

MD5
8c3154086611f999c1fa29d937953779

SHA1
db5a0077e12d9324f14d4bfc18791a72277d0bf9

SHA256
413f0cf07776ba948bda4c3e79ccc116b991d81ac9e618bacdf84b82970bea9c

SHA512
e53d634f017b9f855b6034cd20b0aa458ba4b3574a96ddefe4b354d96ae26844cd6486692df778e1c117ba653b7a11e70be713f131297e6f85781ed930c2e6eb

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
84KB

MD5
58c9a700e18b4895be5ffefae1e2229f

SHA1
d24922c8b287d3bd82f211a25e9bd5c2dcf8ad6d

SHA256
f94355350acf00040cfd5326340647a1d47fb53bd50e68f3d7e324fe0cd4b76e

SHA512
d99202e018ac29dd2bee0cd4c2e0d3118e6dfaa6cd9c3ee01a41fb1a287256487888f87f4f53fdf9123c0f96f75dc0a5811968d67991e54b1fa902943ee38eaf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads