9d58a3188e1a36bcdc1a6a33a809a4391c277c34b2f4b06a411c522541813ff2

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
Size

131KB
MD5

b831a4c4016f84c774a0bd0764dc7220
SHA1

e383b71d94300ec28e5d7fba7e9e860da92ad3b1
SHA256

9d58a3188e1a36bcdc1a6a33a809a4391c277c34b2f4b06a411c522541813ff2
SHA512

b5ed42e2477bbd359b723c616f56df9deee775126ba9d95025a37da2a3d885a5bd0b19a09406d0f1f447004a474515af025dc63b8717a0e1896a46fa4a885b88
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXBvjfMfvjfMMfQsblBOz:/7ZQpApUsKiXBvzwvzXJvlwJvl5

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\1047x576black.png.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Dawson.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckg.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\play-background.png.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pago_Pago.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santiago.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\vlc.mo.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Midway.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Detroit.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.security_1.2.0.v20130424-1801.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationFramework.resources.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Net.Resources.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\micaut.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Chagos.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b831a4c4016f84c774a0bd0764dc7220_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
131KB

MD5
79e83b27d8a82dd03673b0df3bb5ea4c

SHA1
1d2ce70e23104619ff77d392085da456ab139226

SHA256
5c448209ee06d8f417a2ce3e2d22198fdbdca445838c1115c8986ff26c2a88a4

SHA512
ca58c52cb9de7073f296b33bace9c7f4138c81098a23b5cf09522a8b47f466acfaf8fc0cc95110a948519e276d392f253e3a0032c724e7e373edd2bf73029503

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
140KB

MD5
8c6e7298c41fba373f8bc88ab5d358ba

SHA1
5e1bf24dd87db6d6b44db11dc5e2ac042f6efd79

SHA256
4fda5be3269f5b609642e70dc66adaf5ff832630898398faa0886b18e80496ab

SHA512
868153a1f7e55a78dc33f81ef3371adc73fb43bf66b4039a705037b242669073743d557ae140f843880f9f87174276adb7dc3467273b27ae62273ea36258c654

Download Submit
memory/1992-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1992-574-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads