00aff046e710a49e1c20824a8b1406c12745ef8fc107a2a368534cb52a65a885

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 08:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
Size

91KB
MD5

b17694950c1f40876213d42b52ed81e0
SHA1

1cc3c84115ead5f4f16d896cc16dfb49f6a51f72
SHA256

00aff046e710a49e1c20824a8b1406c12745ef8fc107a2a368534cb52a65a885
SHA512

4168fbf3b1ae165b9099f0f3302db77820631de73f6c691b27c406f4f08f336799610d2da94e93ea92aefef93d11c8dfa14bbc9ee9c1b94497f200786f0f3a5e
SSDEEP

1536:W7ZDpApYbWjnWf05PG0PG26IvxvWyCUyCGjjW+jjW4Kz:6DWpDWYPxPTJe4cjWEjWP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3517) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-tools.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\cpu.js.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_zh_CN.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.services_1.2.1.v20140808-1251.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_ja.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationFramework.resources.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Swift_Current.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\vlc.mo.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsdl_image_plugin.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\settings.js.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.app_1.3.200.v20130910-1609.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Gaza.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\PST8.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.engine_2.3.0.v20140506-1720.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_MATTE_PAL.wmv.tmp	b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b17694950c1f40876213d42b52ed81e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
91KB

MD5
7b77e13b51e3155bc65bcb236b0c1419

SHA1
b3ba3e3d236998a5404ecbba07b110da44ba4ea2

SHA256
e09fb9356a20dee3ece335da1f58a47c80e088fc8fe3b03222e16c0bae5257ce

SHA512
f2216a2408956c65408a429c9531ee917131c408b7c2c310bf2026a34ac8f19ec006107087d4a6d8d3e2032b0c919d7893734346e42c97c09aee9626c1f880e0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
be3a97ed13c6c3c7a6d4aad487b08d86

SHA1
ca321ad913a169d0aa52ef047e33eb0476d23261

SHA256
c59f0fa71495f5f432f455b4641582ada374184ab73b14cbc712e3c35b88c1ee

SHA512
03641ee52db02e6b13e2e8eb46c74f8d706e90e0c7d1cbd27187ce6355ace57a9eb0adc1d29358d3123ac2faf8133b631066271401014208ed279f50d5f7e4c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads