a8a9cead4810021a281b6e7d1b559ee5d8a45ea17d708c4c9c7a7ac544bfcc04

General

Target

0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
Size

87KB
MD5

0b2048816d26e8e71d488cf9feed1c00
SHA1

fa741fe6a71ade2572655f80b587b031c0459b42
SHA256

a8a9cead4810021a281b6e7d1b559ee5d8a45ea17d708c4c9c7a7ac544bfcc04
SHA512

410089f4409a7daca824d9c4a68ea29643262ea1bb251d9860b798b66b1d37364b37b0316d019e11f00b6b18aba3c0fe19abfcb26e841f6dec0c76193c51ad68
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEht:6pWpUFpEhLfyBtPf50FWkFpPDze/qFso

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_win7.css.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\tipresx.dll.mui.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Management.Instrumentation.Resources.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_zh_4.4.0.v20140623020002.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_zh_CN.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Linq.Resources.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+12.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-uisupport.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\dnsns.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\Mahjong.exe.mui.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Jakarta.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\es-ES\Mahjong.exe.mui.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port_of_Spain.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_zh_4.4.0.v20140623020002.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0b2048816d26e8e71d488cf9feed1c00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1724

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
Filesize
87KB

MD5
012987b4b9ece5459b8950d3124e2bf5

SHA1
3026bf5ca12a2830ede350ca5603e37a3573b4f8

SHA256
51b8ca91cd6c096ed3ddb39fd210f8817aa7dafffb239f27cc43ce544356e804

SHA512
87662c92ef5cd2be85149a606534608418db2dc84780232c5448c1c3bd37576c4d66bfa80194a802abea2e840c98640cc80c49b6c4437f908f467f1912db1e27

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
96KB

MD5
40aafb7df8a1d2f667eab70f4e84d2f7

SHA1
2c7453ca5c35b818bcece657dcddc6aaeedb3b6a

SHA256
b5e5c4caa9b15ab977e28934618ac379730fa051be9da27fc4d9e14455e95f1a

SHA512
db0d863c5f6f0e8b0017c9160e918f8aaf3ae258e46bea75cdeddad4ac8e98d55e958136553c3794fd02b85242065fe6f9bf93218d99d85804f7b8fc2628bf39

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads