b6e3fd25b5140ecf87289e54913cd37d44ec64d928172f548baaecafcfe93e16

General

Target

00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
Size

85KB
MD5

00a6385e71a71c9e053850307fd42630
SHA1

c48c2d9ecd870424824778a30490a6f0d4e7ac90
SHA256

b6e3fd25b5140ecf87289e54913cd37d44ec64d928172f548baaecafcfe93e16
SHA512

449a2c982af7582e0f59c5a6e65754b9bada95dad9607a22e4c80c177ae9b0ea0a338c994f619e2137f4d656d84021e515dfe7420fda90c02ca934cb4f3266e7
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hH7:W7ZDpApYbWjIlE77ufL2e+efZwZavv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3524) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-9.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\localizedStrings.js.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsTap.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsound.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-oql.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\icucnv36.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Magadan.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.xml.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\library.js.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\FlickLearningWizard.exe.mui.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClientsideProviders.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\currency.js.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Tell_City.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\cpu.css.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot.png.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\00a6385e71a71c9e053850307fd42630_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2944

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
Filesize
85KB

MD5
ed91fa46e6eda488fcc8187e9736251e

SHA1
09c55e24fcd0a1ce2d688258a509aec92ddc11f7

SHA256
a9e0b3586e79771bfba0a1ec95bd4405a87e66cc3774bd14ce2fbd786e9ec589

SHA512
6c0e2831e3cc4c86768a467dd898aaf8ab5f45948d853e9e94a20a976a59516ce47f3c864e58e72947fe0d7d739adfd13ac215395fa9795572178daf0c82181e

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
94KB

MD5
7feb02828fe0506c877039ce71a0a493

SHA1
5df4c5ccf32f21f05fc67cfedaf619aead88c7ac

SHA256
b08568269ad8dcf5eb2762224530382e1a1488d18572d45cc87ef573c04c18e4

SHA512
0a69c32d3379f200b89869e3469b331fb4dbaf3a0e99dbfdfa35826ac8359d5359e1a3bdf40a4775e95d04a1607069c0fe591e95a5c08cd1ac86747373c3aa22

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads