Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 00:04
Behavioral task
behavioral1
Sample
4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
-
Size
103KB
-
MD5
4a27be827d046ffa1fd92f1f3df080a0
-
SHA1
4af1e99da851dec9b8f6b35f60af16291a71cf22
-
SHA256
e2c1f60b7896ea29f08e7d8aa1dea5c9cdf3c9a803e83d9102df634f5d331379
-
SHA512
c1af50bdfacdc69b3b291da5a602652a4f97c81068483ec06b7e74b69ada3712ceb5c648899a9a4b152754f860a092ccfd48cc880fa7c685a3b8f8bfdfe68e57
-
SSDEEP
1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfb:hfAIuZAIuYSMjoqtMHfhfb
Malware Config
Signatures
-
Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000a00000001211e-2.dat upx behavioral1/files/0x000200000001048e-6.dat upx behavioral1/memory/2176-76-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\default.jfc.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\gimap.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libnormvol_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\browser\VisualElements\VisualElements_70.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_ja_4.4.0.v20140623020002.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\gadget.xml.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nipigon.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Miquelon.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Danmarkshavn.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\channel-prefs.js.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp 4a27be827d046ffa1fd92f1f3df080a0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD52ff6ecb4ace5d11c306417fe3eb41c9b
SHA142d97191327638bd0f8bb31db11ed910dbb6a2a3
SHA2562c2a9b84b44c5586a5842ac2f2e632f98018184adc9d14d098c588f3b72f9765
SHA5128901cc49b59ad5f3562d11945ad6167f248ef7c9b3556667bfba8e688fcc0efd162064512d460d696681f081adc7477496d8426021dc24893731a78f0047453c
-
Filesize
112KB
MD5971c73581acab47322c3c5863bd66789
SHA1ca46e25582f65dce535dd205ed322186a316b0ba
SHA256fa8d7f748406f90eaa4e980bf6a47a20afab470f1df48ba8c028e054b1abcb2c
SHA512c1f3ffa95de1d427ab63a8580a0c1794f04ed037c8e81724325e497edd486e742e5a0596329eabd9f786bfe0691df981b71e13ad2f307ef2fc63e722b3fe4476