d4f969e3288206d1535d4038b429822873eaf18865c7a2ff31c5b17dd05254dc

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-05-2024 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
Size

76KB
MD5

1b0b95804cfb88e12cab56891a36f890
SHA1

eefb8a72bf06211ac1728c1a3ef01d8e87652935
SHA256

d4f969e3288206d1535d4038b429822873eaf18865c7a2ff31c5b17dd05254dc
SHA512

6668f89e6f61e6f8f5cec07ea06e372c9e170e590a728eba932a25c08d5b84cc1d2849d0cf5db47cbf683cfcfa47fcefa22d093a9b9d997b33e94d3873df99b2
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t2rt303aq5qE:6e7WpP9oVLQthbYY9oVLQthbUrt7t2rU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3482) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Merida.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Mawson.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\precomplete.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\vlc.mo.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Atikokan.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\slideShow.js.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Darwin.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\library.js.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montevideo.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Samara.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_h.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\EST.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\smtp.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Rio_Gallegos.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\te.pak.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine.nl_ja_4.4.0.v20140623020002.jar.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ia\LC_MESSAGES\vlc.mo.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp	1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b0b95804cfb88e12cab56891a36f890_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp

Filesize
77KB

MD5
59462ce3a66d7042325924158b6aa34e

SHA1
7a2c8166c61f52d2d78acbc513988586c7255563

SHA256
424c5b16d4b5f7e14b6b23507b6597bbebe25816a273880ab8df19f9650e0abd

SHA512
6f42e8ef3e6a68a74672a7066f6b4937fa493baeb35ce7eca4c2780ed157d6f91b16500276e766afc76b06e1f8eadda364ad85f2cbcee3f70dac78b587c2bf04

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
86KB

MD5
1cf49beae0f130ce9564fb65c6ebe1d6

SHA1
5257ab29bbdd7cafd6cad650af148b571cb51bc6

SHA256
c76e49d8c889bd915ccf1d0e8716e60a6f9fc09295612de9d3a3e1d15437c1b0

SHA512
fe91763c0f21aa17a8300481c6a6ca0e048f0db53bf86066742ef29c7f67339b86c95090bd3cceba8cb6e36a164496935c10e55bca756472605573c71cb86b5f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads