030bdbfa4657d343476ae504203c6215a1055f59d55d434f9f8d973e01e7e044

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
Size

128KB
MD5

aaa5b212b043cccf31c973adb025e400
SHA1

ee24efd4b93651cc6945899874d5b0389a058242
SHA256

030bdbfa4657d343476ae504203c6215a1055f59d55d434f9f8d973e01e7e044
SHA512

182bdbd5c2f012cbc30c996fd411d241bef4c20fbb1309c512e860f2875adc97aeaaa20b2f481d7e50a6b4d928e050165b827bd23190513e8c063c76c0fa66ca
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c50KPKu:/7ZQpApUsKiX26KaX

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3429) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libvod_rtsp_plugin.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Eurosti.TTF.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\console_view.png.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\skins\skin.dtd.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\NBMapTIP.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\COPYRIGHT.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sendopts.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\fr-FR\Chess.exe.mui.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\blank.jtp.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Boise.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libyuv_plugin.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationTypes.resources.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Management.Instrumentation.Resources.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ko_KR.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libddummy_plugin.dll.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aaa5b212b043cccf31c973adb025e400_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
128KB

MD5
5fef0f2383f7ebb15d64691b149da3f3

SHA1
87b46eab9a0315ba0deb786ec044aee39ad54cb6

SHA256
5d21cf4c2826f1277642600b5fa38013e066d6441401a610e4a244cea6186857

SHA512
3574e44188f3518ff1c39ca96481be62e65eb5cad0519a23c8148a3bb10a68688bb81e365d904c3541dffe355104a1e91587d81cf1990a1a54869ad0a57b7410

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
137KB

MD5
914ac28ade55d8285ffa0150d2072998

SHA1
5d60e08f4a2d4456e5949fcff8595070e6944e61

SHA256
be5598f4b06974bea41e8d526692017fec95062ae215a3976ec73e1d2155f546

SHA512
612dc113f47e30fedcd0180695dd4bec58fd542b622575bd74e25dadcf5edbeb2c6238e07737ba1aa43d6658014901bec47324458b7a1d40780f70b7b7ffd070

Download Submit
memory/2936-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2936-638-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads