5b456c7c27e9d1efc91343cf6cadcd67bbca1db28f1e0f2255ebd511f7d515f9

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
Size

68KB
MD5

9a288e321ed889d6581c7a28f4f164d0
SHA1

f6956022828b8e88daa74ce5833a0bd58725dbc9
SHA256

5b456c7c27e9d1efc91343cf6cadcd67bbca1db28f1e0f2255ebd511f7d515f9
SHA512

678f943fabd9a65b113397e72a8f4ddd8f9cd3637c1251dfdd3f1055d983826cf48c7cd6262c992dae2645fc126b206be141c938a1b808efda457bc732882100
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyukfvw5R5l:W7ZDpApYbWjIlE77ulTL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3449) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\Journal.exe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCallbacks.h.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jaas_nt.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\slideShow.js.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\epl-v10.html.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-down.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Mahe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\MSOERES.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\init.js.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\wlsrvc.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_ja_4.4.0.v20140623020002.jar.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.DLL.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-io.jar.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jp2ssv.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Noumea.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\LC_MESSAGES\vlc.mo.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-queries.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
68KB

MD5
4f29676332ccfd318e4f209a7457dccd

SHA1
c126de8094807e0e6446e18d60b0cef6839cebb1

SHA256
9ccdef90d8ae60742c835a45fb2b2a74c21f9d62745b8e46dc58bae80a716acb

SHA512
8569b64fa1fb258b279ef69e44bc1ce0273fdd996205ab137c8dd19398fa323dca9cb17841bfed5ebdee05f8f7c7eaaef3d6bcb0f53c0ab97b90451fd0fb6eb1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
77KB

MD5
6390dd7002236a17cbdadf1e1ed9bf35

SHA1
bad2eb5bab7e8d40d60a23a58e27b210bf7ffb52

SHA256
b06773f8d39664a05245beb7fdf2e753d9dfda85bf65df8f0a111e6b0f3275e6

SHA512
90d486a8a489b36ca6ec68921bb2ad2686d46bd55f56af90201b27bccb7037820cf14366b6cece7c0a870245316e8e2bdb6fbc130659c4dec16b42cfa1c99fa3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads