f299d04335643d3bbce66db238edc0b43b25be6a7424386a7e022dca514cc558

Analysis

max time kernel
131s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
Size

99KB
MD5

d0b2faf3970ad39429cb88c20a6e0680
SHA1

1a30dfbb1e6bbaa31eed1492d1ba144faa176be0
SHA256

f299d04335643d3bbce66db238edc0b43b25be6a7424386a7e022dca514cc558
SHA512

099607cd2c9273e6a735973acb45c9ad7f5c47dc844875d949e8387fda70d3ae52ec2df5c4998cc43303a16fb1e09b6a1250b56f9c29cabf8f69fd4adfe04e02
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOfFpsJOfFpsJagd:RqKvb0CYJ973e+eKZ6gd

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-favorites.xml_hidden.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\en-US\chkrzm.exe.mui.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\w2k_lsa_auth.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Casey.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Recife.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Chicago.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\More Games\MoreGames.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationTypes.resources.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Dawson_Creek.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.RunTime.Serialization.Resources.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d0b2faf3970ad39429cb88c20a6e0680_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

Filesize
100KB

MD5
70027f472096b07439d207f8554934ad

SHA1
ae4cd78a05b1affe791f0341e7b85c68c815325f

SHA256
fcb35b424ffeea2cbadc73b470a435a5c120ca83cd22346c8a3edf5a8506dea3

SHA512
c38098e238f29bdb5e616337ecd0114832d116c6127594480901434b8db30438facc2b9a1d0d9a64715f0280e98e7ad1963bc9fa19903e9984045b634bd569f1

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
109KB

MD5
94f420a2f65fc36eac2ee9b369f0b47d

SHA1
5c7f7b67e90bc46e5a66f7c452307ed01f110734

SHA256
22c8140b7ce6289387b66483fee5f094e6318f0f4fa959be8653b82ab379597f

SHA512
ce3be10a96aef2715112d6ea2885ad7adaf7f97c1a538f81cc0e4b0e12705d642e3fc1114c853484cd21113d52e5c21c7f60301a520a0a59cefce7c117b1118b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads