5b354a40ae3a2137f56b97eb774423b4a8e2bf2695efcf647a55416951158a01

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
Size

128KB
MD5

ea6327b2f0ad17e9745b737c528b0660
SHA1

663c1ddafa9eb3889314d74441f99c3cf2f6da22
SHA256

5b354a40ae3a2137f56b97eb774423b4a8e2bf2695efcf647a55416951158a01
SHA512

e70eb91531a10b566977fa98754ac63cfbae31759ab816bcf901607fc49fe769c2fd0862113b8ff9c7f3bfb88b70401fcbb652f472a49deee8e02f9a7c7a38db
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzu:RqlIyFESWu0SWuGSwxR

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3422) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.httpcomponents.httpclient_4.2.6.v201311072007.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_it.properties.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\GMT.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Tucuman.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\FlickLearningWizard.exe.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Bermuda.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Linq.Resources.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\en-US\Chess.exe.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\de-DE\OmdProject.dll.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\content-types.properties.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipBand.dll.mui.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ea6327b2f0ad17e9745b737c528b0660_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
128KB

MD5
7774ca7129c24431a255c5323346cb25

SHA1
9b3937ad584fce01770f127e97cc200d0cbe462f

SHA256
215264e315a939496d5605c960b2f4441c6b4d78a60efc0c073e18bd853a5157

SHA512
605d000fb56d4e4f26d7ce15170575bb159566ba073b720a7a38e513fdf74c97e4c67b54ed1ac808cb3fd60f5f4135f11b8ae362d8d02c8b391f57ad1e7d8062

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
137KB

MD5
f460489188e9643f77f2af2d40eaecc2

SHA1
e033bee89212e78c13817533b628f70c9ac4e481

SHA256
11d49a52911e47aa9ffcbf9b5baa51e5e43deddbb83cda82a35c26cd7f542ddd

SHA512
ce5043f5a153901c2170ac56d79f3528d98cf0657795acb1f35bf1397913e2aace117ff2d1c2a3a2edf4b3daee0a77b756fc3c7e793b2f63219519e7c02bfa45

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads