5fee93154903b175ee638d017f352ae7580fb637b24216079b8ed34cc0c35028

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 11:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
Size

104KB
MD5

87f75daa05015fef8b0ebbf32d4f73c0
SHA1

10347266985ef2c50bfa32aa761bb4c71c1ce556
SHA256

5fee93154903b175ee638d017f352ae7580fb637b24216079b8ed34cc0c35028
SHA512

559441ea6f0c35cf0b505128dca530c3fc162a95c2382470e578c02012265669238559aa07fed0124de18129649c6ab618c39de00b1e2abd86713925cbaad5e9
SSDEEP

768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5pYJIJDYJIJOO6O2lpHiJOP25LqrH5HiJO/:W7ZQpApjIWe+eoO6O2lpiMZiMjj9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3444) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\currency.html.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Araguaina.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Journal\es-ES\jnwmon.dll.mui.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Design.Resources.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.DataSetExtensions.Resources.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Journal\it-IT\JNTFiltr.dll.mui.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\flyout.css.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Port_Moresby.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-synch-l1-2-0.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationTypes.resources.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\calendar.js.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp	87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\87f75daa05015fef8b0ebbf32d4f73c0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
105KB

MD5
1af83d509401b041c605bdfde98266b3

SHA1
89b3643638ddd55aab15a0fa5c3a380d0b068ae7

SHA256
a2c16553e547568948b612caf8f7fd395dd4f99e37c069ac9791823afa4c028d

SHA512
c5a448d3fbe5ff0688a93e152de097dd85f6bb5d1c66d7b362152fea49c9fc7a44e8f9981a18a8d8661aa5204d9ff83f71715a1c0e061b3bf7a96a8ba53981ea

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
114KB

MD5
aaac2e1bbac055d03c633b96dbc9ce85

SHA1
e50ba6c8d6a70a4d080b4104351b25e2b264d7aa

SHA256
7bdba20ab98e956e2974dfa7e05ea59d28eb20745bf6e7ded1943699d147aa68

SHA512
eacb6e36a3417d5ca96fa9c67a6e49dd21fcd9bbee143f6b6a7e0222bab1da05aab57eadca00cbd8772fc05f111047bec8e6ac70aa65776f95dc27b840700631

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads