8fdba7526285688035b65de90e6155391d579341b7bd31518ba66cd9cf50de0f

General

Target

6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
Size

87KB
MD5

6b876405b86a0540a7cc855bf82124c0
SHA1

5c32cb67d09406d4fe944c04004650061166d524
SHA256

8fdba7526285688035b65de90e6155391d579341b7bd31518ba66cd9cf50de0f
SHA512

269340ebfce11f026c0c3080025ff2619d2e0e9230727218514c27ac34333f5747c1231b838a52bc0b94d928c2381ffa2317444eacf791ac50da37acf0ab2f0c
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaDgjgm:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXH

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\gadget.xml.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp	6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2908

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp
Filesize
88KB

MD5
21645e5cc8006b4e34e7d9fb957d59f9

SHA1
af3060b31a0fddfa1573e3051d76f04f07e3319f

SHA256
388131f53aa77e0c3a28d2da5bc2f611dc068c28caeb6fc6f7bd7f88705e2050

SHA512
cb71d6ee7459d5c3c27d9cabb3ad0030fcc540c4c63f789c3ac938ad4c3c230c8d1f52df65c9539c03f6804474f586da78dce004b98f536adbc0fba7e0770560

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
97KB

MD5
c6ff2d8863158ed13b7f4d4b0d9dd66f

SHA1
b2b78395dc25001ece856d60986202c7740bb984

SHA256
d5995e98c711df23cedc4e20e38591796cf45da17e7d1a85a3f455df69e21f46

SHA512
61687b00402abd15b17707bd6366af3731b092d7de905a0d737aa39715c54559d78fa4b5d6090ed78e2a046a79d063b12574486fca0595489940eb67459dd27f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads