ea627203ed673eb534e28066a1f406b8f03af070d7794692fa529c4e33bb0bdf

General

Target

f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
Size

84KB
MD5

f3a843836de759d81cf8a15286d52760
SHA1

2ed0ac1626c1ba233f281cfa09167c22d77591d3
SHA256

ea627203ed673eb534e28066a1f406b8f03af070d7794692fa529c4e33bb0bdf
SHA512

e7271025b56e88dbc8bf587c6f807d24f63ef707ac86168135e79ac2acf67ebb3c51f4b7c46d508af60e85d3143c70471167e063156e98a9840cf55e1853f09e
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXarW:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3613) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_zh_CN.jar.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_wer.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_Off.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.CMP.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\UpdateOut.xml.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_av1_plugin.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-horizontal.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Sitka.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tahiti.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\OmdBase.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.properties.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\BCSLaunch.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\LICENSE.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\timeZones.js.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\calendars.properties.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_18_b81900_40x40.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\settings.js.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\atl.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\profilerinterface.dll.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Buenos_Aires.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.tmp	f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f3a843836de759d81cf8a15286d52760_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1532

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
Filesize
85KB

MD5
f057222e54ca31776432ea3efe8d797e

SHA1
6fb752936e1b97695a25b5b155bc5adff9d5cf23

SHA256
95b6809d3e31e9d3540519cf0478612a78a27ec69941a72d833180f1f24d62b8

SHA512
36eb057a362071d525bf88164cdf33f5f1a4396d9091156cc94d0afd87727da108abf12dcf85caab78d99fe81293ad1fd1cd5dad7f29f236cecb1ea0236b5a92

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
94KB

MD5
e630a2840ada81018b7e6c4b020fe705

SHA1
142f681a1cc517cc7427722f522f028004391083

SHA256
e8978716555f50623d6bc8b32337a4f004bb9bc5c7a5bd1b4bad75951dc1b482

SHA512
094372d5ed18efcf449b16320a33b8990ba8073f8f797f05a7c9a7c81f6198d1060e501b4e22ae48a3dc85c31332edc286d985314bdca0a101a5ebfa8e7330ca

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads