ecba078896a7755a340b3bede496001af57f9baf8679228ebd801a7e4136d45c

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
Size

95KB
MD5

84cc4e63f1c3a2a34de5bb8233ea7680
SHA1

616262f1d2ebd0ccb9b31b237119b3f844e3d4d7
SHA256

ecba078896a7755a340b3bede496001af57f9baf8679228ebd801a7e4136d45c
SHA512

a9ac7e04f4283afc2f2d914ce3f61bcffb96d42208e6a8ef2136f5e9b2708297b72f60036ee619b5a8098a1f150c2cef087f858e08f2b6e8fe872bc5cbdcbec9
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNlOmOMymuI:6rWpcOPxPke+e3fFpsJOfFpsJbgEbThj

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3451) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\HideFind.crw.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\instrument.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\TableTextService.dll.mui.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Juneau.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmpnssci.dll.mui.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\manifest.json.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new_partly-cloudy.png.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yakutsk.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Eucla.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\clock.js.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-charts.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_delay_plugin.dll.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp	84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\84cc4e63f1c3a2a34de5bb8233ea7680_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
95KB

MD5
f85aeffc0b4a43d32c5d44ace65330d0

SHA1
03972f59f5686d75ca5220c064e076c19519b392

SHA256
d5a96aea64960dcaee07575a3d19b03fdda8c6c3a0b5a7bd6d85752eaac4cb7e

SHA512
ed36b7c65ff6d89f5a063b896c5166ccf89e7aebe9a1e0f3140901ccdaf5d307c371e015e47e5c89bd622fbba0c8aabca7a412fa3807bf93bbe68df4b487b8de

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
104KB

MD5
8974b424eecc2047841524a2462f40b1

SHA1
9bc0e047e8058c25410155ac1a4c4370b8b79f98

SHA256
719d9802af5c16a0768dc43f9164ed18955ba09ed0120a753b97c123c17b0d41

SHA512
25856f6c86f3cd6222d2e7ddac1295b2e83487e5948a7849fca90dd268e09419dd4070147b4ac032662c1b9f6fe2afbdaa71f905e82ab62ce91331570433dea9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads