73dfd53d2ecfd3ddd51551c0a86fd847b8ac2301240e7117475808d5bc357d7e

General

Target

25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
Size

83KB
MD5

25cb1c290f08fd6961943b7b954b5b60
SHA1

4403742f06cc1b13e085fc5914fbeb7044d2187b
SHA256

73dfd53d2ecfd3ddd51551c0a86fd847b8ac2301240e7117475808d5bc357d7e
SHA512

5cabab0678415b0f53faea858448dedbd09e17b7a383b8d3380198cad6417b30789d7f22a8f25b011b87fd66cfc91c094fc736205541cdfb8b781eb296431d7d
SSDEEP

384:GBt7Br5xjL9AgA71FbhvoBlByH3pgfnc99bNXyH3pgfnc99bNq:W7BlpppARFbhKyHZgfcL5yHZgfcLE

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_zh_CN.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\main.css.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\PhotoViewer.dll.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Jamaica.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-environment-l1-1-0.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\Accessories\fr-FR\wordpad.exe.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwingdi_plugin.dll.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Caracas.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Oral.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgzm.exe.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\es-ES\msoeres.dll.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\gadget.xml.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunec.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\UCT.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Vostok.tmp	25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\25cb1c290f08fd6961943b7b954b5b60_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2512

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp
Filesize
83KB

MD5
e752df0ddf5770a3f8cb845f1f9855eb

SHA1
d43c506fea61ce08d16855a2986e7e28d366e623

SHA256
521ffb916c4c08fc9883b0942550caff2295f46d56c3459fea654154b9a836bc

SHA512
77c5e9f7a713baf7a18f2c53c261b069592092b4673711fad1f9b48f6cac73ac1178e4c442c752f479718b811e456b16a091df5c16455b09dbde18b3a221d315

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
92KB

MD5
8c2a3a3c57f44edd286ba7b374946c38

SHA1
87798668857c660e84e1c4907cbb46b1ead6ce79

SHA256
8f4521d5df530b22592672dbf47973319db97e3f24f80f24a3ca315a920edcb7

SHA512
ed8bc46c9d20fe902dd293b401cea550527f6c64fdf63a424826167ba1cea0474c5cced7d49854a470ddaeb5aaba2136dc06c1133a7c1115e0e0d7db8e8b6340

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads