139a207c8c89645b9e28326a29c333af3d488aada3ac682a37a72ce392923434

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
Size

107KB
MD5

628a29e9a7ee5ff1278c197e993b4970
SHA1

b4bcdb2404409b8a8d6013336815e660cbb394fd
SHA256

139a207c8c89645b9e28326a29c333af3d488aada3ac682a37a72ce392923434
SHA512

8fa519d2e88811b1ae604acd495ad598884584493b4b36a516815435bdf7b304614e93667ba33d966e40dfb32d025f7e2740d4bf9bf0d435cfed7f6fa213dbaa
SSDEEP

768:W7BlpQpARFbh2UM/zX1vqX1vLFB5W5pYJIJDYJIJOO6O2lpHiJOP25LqrH5HiJOp:W7ZQpApjIWe+eoO6O2lpiMZiMDjwWV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3462) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core.nl_zh_4.4.0.v20140623020002.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\FindAdd.3gpp.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libsapi_plugin.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.compatibility.state_1.0.1.v20140709-1414.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPDMCCore.dll.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.bat.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.access.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chatham.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\AUTHORS.txt.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\anevia_streams.luac.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\it-IT\Journal.exe.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Berlin.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Fortaleza.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.properties.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_zh_CN.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar.tmp	628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\628a29e9a7ee5ff1278c197e993b4970_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
108KB

MD5
b23cbbcbcf87041ef0c5ca02461f9493

SHA1
54f725f596030d9210d1f1d20a80f759ea72f636

SHA256
8d4ad9f93d31f01768b962a5b6f50c579417163f12643e16ed06f495d7fe64e1

SHA512
0e7da2d01a6374021ef5fd442cbc427f2b7e57781aa54bd201a15e07c4e501c17dab42dcbd19392cbe22e48c3ad34aaa689d46fa64cdb0d6ec9cc8bc1523241c

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
116KB

MD5
8b7f6e9f192a1248ddea91b1fa0865e1

SHA1
06f2a1edfc9ac3768c6aeaa56f446898df66d53b

SHA256
7060cb137fded380f78c861aab84b5e39291f70a0a01ef6bf72d79c10e4e286b

SHA512
827650f5133ad500748382d9a769c7eb2c561803777e3443e2a21fc8071216331f41175cefded230fb39dfa7b38682faa5100ab996c089b7780ed44366d50f74

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads