acbf68355a19a864f1b3e0e6760562e5357cc2d15a9f58b583eb1004a64dd1be

General

Target

8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
Size

82KB
MD5

8c5be0f79aa057f32c4381b5e85c75e0
SHA1

1c30cb5c7b74108e3f5237a138aaf57530c8cbee
SHA256

acbf68355a19a864f1b3e0e6760562e5357cc2d15a9f58b583eb1004a64dd1be
SHA512

1b39d882882fd1da319a99cc16d4bed126a1e54cbcc5fb4c2ad5c5c6cdf5a75851cec5b41581220d52ad0723ec5bd97554e0531b127636460488b3635a2a10e2
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReR:W7ZDpApYbWj2WTWJe+e/qXhg9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3533) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\calendars.properties.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdca_plugin.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libasf_plugin.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\MSTTSLoc.dll.mui.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jvmticmlr.h.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\vlc.mo.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\CompareHide.doc.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\management-agent.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Canary.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-templates.xml_hidden.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tarawa.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\vlc.mo.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kathmandu.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ja_JP.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libts_plugin.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\gadget.xml.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationTypes.resources.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8c5be0f79aa057f32c4381b5e85c75e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2940

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
Filesize
82KB

MD5
8622e799adf315d109990310c6081818

SHA1
b495ff703095b29fc502e53c8e32301db7611710

SHA256
9d85e261bc10f40f356c2ea76b5a7c076ec8e99e95c48f488400262bda43ea8e

SHA512
af92c4cef03e104f0d11f53331bb6b3cf3828f3180db4d642523188fd25f4ef7b53d3680875db19a2140a505ed971851dade522f541ced99fd97d9f203baed21

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
91KB

MD5
8c72da2685f4a4b1edcb85b5aefde279

SHA1
0c5c6d9d2c4660ba83061b2b1655af496fdcdaef

SHA256
98f2811c934c4251e4b731d9e941580ce92c82ff598f6cb5c7762554d940b9f9

SHA512
09e6f1f0b4f59f25e9da9d6e11beb5c2a5d2783f81ff3edb5d87c047519de49c7d36621a4050890a868b6fe45ab23008f5955e899ec22eb86b0a0745b1eabc19

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads