cde1829aa846cf65afc4839eb6e7df0f7811bb0a43d8eab29cd23045d3ae83b5

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
Size

297KB
MD5

88522cfd871a8d5d6825e03305fd26a0
SHA1

7c401c11ba165b243ab14fac5cd5a78b878e811e
SHA256

cde1829aa846cf65afc4839eb6e7df0f7811bb0a43d8eab29cd23045d3ae83b5
SHA512

01dab607f3e6860ac938268b99144b5ea4d94fd3d71dac061bd70d67bd4888cb573e0d1f224dcd3bb16cb29fc0f7153a53072576b90268a591edf8ee163f3263
SSDEEP

6144:RqKvb0CYJ973e+eKZ56itOImvjngu7/BRXF8z/LYIXiY2+8AFC:vvbxYX7Z56OOrvLLe7LYIXiY2+zFC

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_zh_CN.jar.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\msvcr100.dll.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIconSubpictur.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\jfr.dll.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\management.properties.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\it-IT\DVDMaker.exe.mui.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_ButtonGraphic.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.servlet.jsp_2.2.0.v201112011158.jar.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\locale.ini.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_sv.properties.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Amman.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_ButtonGraphic.png.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\88522cfd871a8d5d6825e03305fd26a0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
297KB

MD5
8ac287e36e73fdf45f14c97564f96839

SHA1
d1dd2b611262111c1a1e1e4058c98cd73a23bc1a

SHA256
66d140b1d908e6593111e75265267c67caa4f61560195e56bee6757ee3bc7a51

SHA512
990585ab9e23403fc28d9f693a732db8006ca648cc63e7da4bad9228e24580da2665f438e38c830d4eef8b51019b2a30a5cff59f5aac64c2a30ceafcb44a1dd9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
306KB

MD5
8036212748ad2c70f1203d4dc601769e

SHA1
a7829649362b9f98dff26e77648e8ea40e829663

SHA256
070d810dcae3ff08b46c311b351aa5d79c46889352043d7f3aef3ca795fc5838

SHA512
c513f2105de5f28506f7fb23824b332d664ca0d035678e7dafe6e7aba3002e9fa7eafc033902e7cc476dce8ddead7ab7544a8fb012e90d796af31bce631a9012

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads