e627e01d805593aea1806b1372f5d19cdf9fac8f12fdd4e2329f22d407722341

General

Target

30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
Size

83KB
MD5

30142d7cce40dbdf280445ab7253dc70
SHA1

0de71afaa6701e7427295b664169e11529f54431
SHA256

e627e01d805593aea1806b1372f5d19cdf9fac8f12fdd4e2329f22d407722341
SHA512

4719d5cdff33b4feb04278441bc11f4ff0ab31ef941eb7a767814ad13103858068bfdc1dcb9797329e4ec8d28eca7edc37cc2cc7e68ba25472977e9ce062dad9
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76Rbe:6e7WpP9oVLQthbYY9oVLQthbUvZ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3444) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\weather.css.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkObj.dll.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\MSTTSLoc.dll.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-locale-l1-1-0.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libadf_plugin.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\calendar.html.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libadpcm_plugin.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\VideoLAN Website.url.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\de-DE\JNTFiltr.dll.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+5.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\en-US\Journal.exe.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sm\LC_MESSAGES\vlc.mo.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libinflate_plugin.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libgoom_plugin.dll.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp	30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\30142d7cce40dbdf280445ab7253dc70_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2060

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp
Filesize
83KB

MD5
5b99062f1639e7ec46cdbc78b682bc9f

SHA1
2eb9ac69937baeec806690d30e14136ca9f31814

SHA256
0e33f08d27aa4b6e3cd700c8199e2ecf5192cdd762a54e139baf1f98aae1fb4e

SHA512
b8d8644b2429c8de8f5fc359897a8c142bb2af3c6a0eef23648d4fc4dd9ef31b85d137da2461b6c0e1bd17326e3221e5159a7a3677eaa87c3695535d581d85e3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
92KB

MD5
a7cb8a12735bdf88a8264ed81a4fea3c

SHA1
b1d830fd80eb5ac28794f087f540bded96454e63

SHA256
ac3567c0130606a00564e95f46ea78a1f4ec5f3d707b7b2c2becea2cba30b039

SHA512
470b1352099d7ef642bf53afe37b10143f21a46a8fd67c6761d7119166d5f0db9f08f5977853ce6c3affec2f18d1ee71ed8537ac58d6e157272232b2691b2317

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads