749b2326c1e8f24b704daf4df3f7ea7c6b49f61e8a3bd81c161a77d19a00fb67

Analysis

max time kernel
146s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
Size

84KB
MD5

d21a93ea107b8396c94d5d00e8136800
SHA1

ca7a2bbd39d0af9d8c4175a11cd6af9517cd7cd4
SHA256

749b2326c1e8f24b704daf4df3f7ea7c6b49f61e8a3bd81c161a77d19a00fb67
SHA512

14179a20822dfd6ce6c9966da74bcbaa9b70886abb8e0b27142b3217c28248cc73a804411a7bd39f64fe1195a1427ab88bbb07fe39aec819eb11ff54619d9953
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPq0:6rWpcOPxPke+e3fFpsJOfFpsJbgET

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3434) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ba.txt.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_zh_CN.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\MpAsDesc.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\timeZones.js.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdtv_plugin.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\twitch.luac.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-over-select.png.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\kcms.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground.wmv.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\UnpublishImport.xhtml.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\it.pak.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jsoundds.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\SpiderSolitaire.exe.mui.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\mpvis.dll.mui.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Xml.Linq.Resources.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mp4_plugin.dll.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg.tmp	d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d21a93ea107b8396c94d5d00e8136800_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
84KB

MD5
39354309d29411a59607488c171fd65f

SHA1
327e33442459661565d0a2c5c2d46927b9c73427

SHA256
043e88d575212cdd44179d86d997b0701c65cfdeb37954369b5b6e1938721b16

SHA512
45e7aab8e27b0b9e91269ddf75ca25c34c04f8815dff8ad7e47d40e862e87d76b7f35ae9d43e90f006e066359efa677e6951e29661e0f365f0592e97ea3b3960

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
93KB

MD5
52ca03870354f3ad468900623a9b158d

SHA1
e3b7ad5e3a7890508663de4a2bab79ded88bc6e6

SHA256
028f57d14d3f8548641513fe0c7738e0156c4d89d30f0005643de8195ef39db2

SHA512
835ccd3867ecb0ed582a2969350e9dc6a9588287fe56d781c8d6492a86c9510c44fa5fde63b1ab46f4f9f7f5926f2a1132fdb3544a510e2fc1a703c6863df709

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads