419ce29a7f043828020e623111d1e333a019091c5c42f581d500667df188e18f

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
Size

79KB
MD5

73bb064b2f44f6710950b47ec136b630
SHA1

c9a42a55539f4b29339a4227e412d6e98014fa69
SHA256

419ce29a7f043828020e623111d1e333a019091c5c42f581d500667df188e18f
SHA512

0179a4fe7986d44bff29eb37a1a3f526a44fa92f2af583468eaee71e95a7cda50cfc40ec10142ee9fd5a24541730a1595c599b6d077994d2b8fdef6bc58c6d80
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhh:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3668) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Guyana.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPDMCCore.dll.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_VideoInset.png.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\cmm\PYCC.pf.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-private-l1-1-0.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmad_plugin.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\conticon.gif.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\library.js.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClientsideProviders.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\wab.exe.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\Sidebar.exe.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\policytool.exe.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\weather.js.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\El_Salvador.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chuuk.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\java_crw_demo.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

Filesize
80KB

MD5
bc54f8adc9706d1ab52257598e18d4ca

SHA1
d08aac5defb74958aba78284db395002b355e6c9

SHA256
5ab85d024bd42ce4fd41a365a7af240f816fee1797d706d371695bb684000cdb

SHA512
97f5f875bd519a17d12537ecb90a88b42812ff6104eda547421ec7a5718f9347f778050dadd5c9b5d822fc270e4410a8d112f437dc25b7cc2f6b31e1115eba07

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
88KB

MD5
e993f1deec43370da590541b815147a6

SHA1
60fa7b29e3670b32ed3cd923ebd3e4349815b721

SHA256
3ca34c0e895e6d8da1c0ed4b7475a691902b00532fa66f862ac0f55e68a47c4c

SHA512
9bfbc7cedcbe15b277e9113bd14fb0dda8486d38fe11b74631358168b96d7d58883aca220795789585de1cea97c4bb070742e10940fa1dcca19285122759b5c9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads