8811ad2bac9953ff0857a179f14ac5543f1babb8d98987956c30f1cc753f32d0

General

Target

91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
Size

50KB
MD5

91fdd618bea7652fed65815abd6f9630
SHA1

317018532f1622b15596723492eb8f6e2a719030
SHA256

8811ad2bac9953ff0857a179f14ac5543f1babb8d98987956c30f1cc753f32d0
SHA512

f04b4bcd14578c720360a2e81c8ffbdb9b12c020ddd1176e5aefbce648ccbbbfae81bb47843d41be229a0b52cb9fb81e4ba63d483c038b15208a53dfd1a724c1
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5no:W7ZNLpApCZrt8PWGoPWGANdNo

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3841) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_right.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Istanbul.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.EPS.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\ReachFramework.resources.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\PST8PDT.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\shortcuts_log.ini.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-ui.xml.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\PresentationCore.resources.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\decora-sse.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\ACEES.DLL.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libprojectm_plugin.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Petersburg.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libvdummy_plugin.dll.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\RSSFeeds.js.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPDMC.exe.mui.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_zh_CN.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5EDT.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\settings.js.tmp	91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\91fdd618bea7652fed65815abd6f9630_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
51KB

MD5
e28625f42fd55ee4be3ba1bca0f24a6a

SHA1
9c61dd466b5cbfd7302b2483ca086f60182de5cb

SHA256
33d716431ccb59e46fc7fdd47687075e3c6d6cd22519071aaae8ff99637a6016

SHA512
390c125335ac64b81a8253ecc193d0bac364eb478fca9c64ff4c508471db1d33416d214aec46b85794bd0a3657607b3730fa91daee8a8f9e428dea9ad63b364e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
60KB

MD5
c10c5a62e5c7f1a1fe0e7dd0b9f9f12e

SHA1
f295060308ab40c85f92cc6e2160bd49e65b37fe

SHA256
db9c903f42964ae0e90ef99032c367f4221e4ff071e4e011cb2e88720f84b2aa

SHA512
511484380e88ac7054c223351a1558d813654952d1afe771b8bba31b201ee8c430b165be21f0d86c432f1e1de299db40c9177de4a48c1a7fbd9613ad5422b6bf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads