c9ac674ddc7ac1f34868db3dc329cb2c5af80d228d6729d75e0e1a03ea044d02

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
Size

31KB
MD5

4ff2214ef747f2219c6ccbd5d7785ca0
SHA1

65cce7967362fa45e8134f10ec3b3994c148c2f0
SHA256

c9ac674ddc7ac1f34868db3dc329cb2c5af80d228d6729d75e0e1a03ea044d02
SHA512

f4064c7eb93640c7931ef9713b1fbc483bae0c57e873886cde483a789b9a5372a013d251f4408f9189ce63784a85c80954f407c72b970b805d3851df3ca07d6f
SSDEEP

384:GBt7Br5xjLfAgA71FbhvP+7QEfQEijajHjr3Uh0URElali:W7BlpDpARFbhYQkQjjI3Uh0UREIo

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3745) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_ja.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_ja.properties.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\DumontDUrville.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationCore.resources.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Majuro.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\net.properties.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\settings.css.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tabskb.dll.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Windows Media Player\it-IT\WMPDMCCore.dll.mui.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full.png.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4ff2214ef747f2219c6ccbd5d7785ca0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
31KB

MD5
e574a36b398732fd79b36d1416c578d6

SHA1
bd78d93dfd60a25ccf81cdb507cf6fb4ed505027

SHA256
11c5b2cea9c3889c56983659025365e0148ab229254ac6e684aad0a74f3fe356

SHA512
1041e6ce9b0d75425e97ef3cd444e11e0b5606c632d633640e3f9556c8a83fdb1f58921c967d907fe6e6f2ec161f18444a65aaceaa191453961a426ee5715586

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
40KB

MD5
faa740b0d56b0165613172a7b82e72c2

SHA1
78ec40165ea5ff9076b5d352b265457500af1fdf

SHA256
a698d7ab136fcd5fc719435816549fcfd101178afbf418c0c7281f89b2551502

SHA512
8e245dbf2d8b3cfd3b7bc01f0719cfd328a78f93d4112820d5a3fc5346e0eb37037f789197c22813b17eacdcfa2afafe52e652f98383bc488e648d08ce06eaf9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads