040086b4a8cd94228f6b045c0350b18864e992e6a0cc08136c4d89c6fafb1e2c

General

Target

72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
Size

79KB
MD5

72daca0a79fa92d7cfcbf5c5ae4f1a10
SHA1

e8b2ae788930287205f90b0af427e61938ab1f74
SHA256

040086b4a8cd94228f6b045c0350b18864e992e6a0cc08136c4d89c6fafb1e2c
SHA512

dbc5f6a63c3f47514c7ab5c4957653b0a309796acfe956689f3082ce4f34a2ef79270e7dfedf62cf5748f50cb5c3f355aa1e583588960fbef33619cf51bb1720
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHX:W7ZDpApYbWjIlE77ufL2e+efZwZavr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Hermosillo.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\java.policy.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\cpu.css.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libmft_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Tijuana.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsv_plugin.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Araguaina.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\fr-FR\msoeres.dll.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Knox.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IO.Log.Resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2196

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp
Filesize
80KB

MD5
6b6ca39923a3b5e4b68b28e570ee0fac

SHA1
04d0f346fc7abd83f21e6e038bacf50533a1128f

SHA256
eb43fc2bd88bebe1f1b620b9ae6f28c89f09fbcaf2daa59808b0163e5b073861

SHA512
3753b3be9cabf039b3b42205ab6724531d710c0a905fb48fea6ff863edbfa5a980a0f272664f3d5691f16687f800a958692ae6212e9d6a23f51bff12f2ecccf4

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
89KB

MD5
594ea216f7673e61062181f8cb09220d

SHA1
81c09b9854ab900c3bbf2a81804cb64bd23e399a

SHA256
7806fe61cfea61349a0a5bbdcae4639df9f03c40e851b2fbe48b235917c467aa

SHA512
39e37d1274653426c2cf60b14f6c8a33eb3383acf0c46ed8ea9a74edba94343015d1c472a8306ebc80db4b1bb9fe51f10341c1370e7dd95d8a1bfa61bfebdf58

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads