Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 19:19
Static task
static1
Behavioral task
behavioral1
Sample
6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
-
Size
87KB
-
MD5
6b876405b86a0540a7cc855bf82124c0
-
SHA1
5c32cb67d09406d4fe944c04004650061166d524
-
SHA256
8fdba7526285688035b65de90e6155391d579341b7bd31518ba66cd9cf50de0f
-
SHA512
269340ebfce11f026c0c3080025ff2619d2e0e9230727218514c27ac34333f5747c1231b838a52bc0b94d928c2381ffa2317444eacf791ac50da37acf0ab2f0c
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaDgjgm:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXH
Malware Config
Signatures
-
Renames multiple (3513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\Memo.jtp.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hu.txt.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240389.profile.gz.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins.nl_ja_4.4.0.v20140623020002.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Net.Resources.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdemux_chromecast_plugin.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_up.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring-impl.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\jsse.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.h.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_Off.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\gadget.xml.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.tmp 6b876405b86a0540a7cc855bf82124c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmpFilesize
88KB
MD521645e5cc8006b4e34e7d9fb957d59f9
SHA1af3060b31a0fddfa1573e3051d76f04f07e3319f
SHA256388131f53aa77e0c3a28d2da5bc2f611dc068c28caeb6fc6f7bd7f88705e2050
SHA512cb71d6ee7459d5c3c27d9cabb3ad0030fcc540c4c63f789c3ac938ad4c3c230c8d1f52df65c9539c03f6804474f586da78dce004b98f536adbc0fba7e0770560
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
97KB
MD5c6ff2d8863158ed13b7f4d4b0d9dd66f
SHA1b2b78395dc25001ece856d60986202c7740bb984
SHA256d5995e98c711df23cedc4e20e38591796cf45da17e7d1a85a3f455df69e21f46
SHA51261687b00402abd15b17707bd6366af3731b092d7de905a0d737aa39715c54559d78fa4b5d6090ed78e2a046a79d063b12574486fca0595489940eb67459dd27f