14082f871cec69447332fecbf6f510ab82c50cdfaae71501eb8e4d8a0f4cdd32

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
Size

72KB
MD5

0e450871e925a5502efdf854ff082360
SHA1

3eb7f736134c11fbb8f6a375abd8966906c46a08
SHA256

14082f871cec69447332fecbf6f510ab82c50cdfaae71501eb8e4d8a0f4cdd32
SHA512

f08c916c647c14037d1c4fa7ace5bed75937e53ffec56f3835dd9b876c69ae35b83b047e264491d34d0512b2fece3c725a56fed3f9782baacbb272db59742649
SSDEEP

768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2FjJk9O7X7vX9O7X7v4:W7ZDpApYbWjCDOcJf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Brunei.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text_3.9.1.v20140827-1810.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\slideShow.css.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_h.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\gadget.xml.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_zh_CN.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.Design.resources.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\service.js.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_disabled.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\msoe.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Choibalsan.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\MST.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tongatapu.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemuxdump_plugin.dll.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\01_googleimage.luac.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui.tmp	0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0e450871e925a5502efdf854ff082360_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
72KB

MD5
13c4105b4b6c8e0cc69639e4bded822a

SHA1
03014c2b078c2ebd23f53435a034b76d0aa6e9b6

SHA256
e7462edccf0bfb808fdf94c08a7f7b5845d4ea7d12bc12f5e043439a1f785605

SHA512
5119b864d803965ccf721f5c138fa4c549f4c8db5340065649627759910852f5b3817e2d79af9c765aed16d31e0fbef02bea203a0d7cafba58b837812ae12c10

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
ea43d6ce563c86d029a7bbad2f105cb5

SHA1
c41260c31dc5af4e22515b2653b8c6d6be2e50b6

SHA256
afdd0ece8e303cdba13ee54b3f934e3f65077e5225a7e461857ffbab8661ca70

SHA512
b7ad4f17c3d3788504aeea69a8f3932efa680a2ffd8a21adad12089f915f1b5657c7044db1aff9dd703b8b10d72b28f4808f960804c0149fe7bd9585b4791903

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads