9543704d436248a178f13c391cda0c16ed435118b035d2dfd983b2b3ce49b758

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

440b67c8e7180ab43117726eba8df881_NEIKI.exe
Size

93KB
MD5

440b67c8e7180ab43117726eba8df881
SHA1

80dcfbdb80d83a1c1b24a2ff1c923c33305365e6
SHA256

9543704d436248a178f13c391cda0c16ed435118b035d2dfd983b2b3ce49b758
SHA512

e6097c409df309834188afb90b78fcefc8991690ae2d90d3f6e8cd0480fa7f56be84636251adee8c3e0d5877df47ddef8acaedb83392d0037e9fdbce082e56fb
SSDEEP

1536:W7ZhA7pApH1IwVHykEElEa0NQn0NQie+ep:6e7WpnhkElEa0NQn0NQie+ep

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3462) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santarem.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Speech.resources.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libinvert_plugin.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\picturePuzzle.css.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libvhs_plugin.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Mail\it-IT\msoeres.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\ExitMeasure.sql.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeslm.dat.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santo_Domingo.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnssci.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\flyout.css.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssci.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\bin\jsdt.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\gadget.xml.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\eclipse_1665.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Managua.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\sbdrop.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\Microsoft Games\Hearts\it-IT\Hearts.exe.mui.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.tmp	440b67c8e7180ab43117726eba8df881_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\440b67c8e7180ab43117726eba8df881_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\440b67c8e7180ab43117726eba8df881_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp

Filesize
94KB

MD5
cff286d03188e426f2daebbdec1af61b

SHA1
3ea90428f74df846d13d9bb84de6ba9be53e1b64

SHA256
8d1b893e3891c6e074d6bc30ac3b850ac90fa0cbfbd2a7104716fc1a5b327f21

SHA512
02dfe9fae52ddc941b33b086a64febdb4b864cdd4ab62fd67979c6a9285bf07535701db715e210c3572a0b8cffeb9c9a3149a4bd6117584e01ce16b287165fee

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
102KB

MD5
a9e1e2d0987d1c211d2a0c650aadc28c

SHA1
9d4cc692caf19a12b6693d6f29a6c0431848a48d

SHA256
b7c3fe6c2e06c209e91be42f88053e44574599cd584ad60b3ee82333ff313dc0

SHA512
bcc317b5723c8ffca6b408f8a5b4ebe21cbe6eb93fec006adbdaab48f704bdc5299723e9ea9f6042de2b1fe828972344a71a6ddd99621255d98dcf9dc204f302

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads