bf9000651add9350bbf729d1c68f621b92362953024b34cf56a08317319d80a0

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
Size

72KB
MD5

2a5e0fa18bf25e875ccc52a029648cf0
SHA1

5f13a28293ba27f75b6401cef1a96d2192df3880
SHA256

bf9000651add9350bbf729d1c68f621b92362953024b34cf56a08317319d80a0
SHA512

8acd72933537678b96bfb917f40988693e12657222f712978bc07ff57dfcb87f90ad79728ba6c50f690356af89369d26a6a2479d1e4e57026fdb5f30e2a1d847
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/6:6e7WpMaxeb0CYJ97lEYNR73e+eKZ6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\bbc_co_uk.luac.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\FindStop.mpg.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Maputo.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Algiers.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-foreground.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-nodes.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\CoolType.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\ReceiveApprove.otf.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcanvas_plugin.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPSideShowGadget.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javafx-font.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\verify.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Selectors.Resources.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\it-IT\Sidebar.exe.mui.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSFrontendENU.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_setid_plugin.dll.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_SelectionSubpicture.png.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2a5e0fa18bf25e875ccc52a029648cf0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp

Filesize
73KB

MD5
0777b452874615fe3a84fca47462a101

SHA1
99913a162df5ca5c8705b8a179f5c567083e4764

SHA256
6e40e2446a4bdbdf7b275b7558e951d8dde5f757d4b188feae5da80cfa415f1d

SHA512
50000912fdcae79b410addcbf25b98b69a0efcff3666a940a6067fe9851c4b7eaef9b93eff3306cc343be6e97e96f35d3b4d00f95572d3d6681150a6fad8ca57

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
8b4cbb45e672a748d014dfa490e6b115

SHA1
845354b17e8296fa303f81c3231bf5484105402d

SHA256
6e864fb4218c3e888725d0b6edf5571b2dcadf485d1f37744260bef9e98fa1c8

SHA512
74ce47519dc46fed7dd30a9279d66ec14f536e83004a47544687a990a9e716363af54d0fe5b2b55563d588d5684ae21a33cf121ee11b71e5381cfefed7d192ea

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads