5eb4abb028c371d35a78248107350fa8739c36ecac3acf60859faa10564ce2d9

General

Target

3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
Size

82KB
MD5

3b33a83ef62695c82e2875d16de27200
SHA1

4887df3fa530f9e4cf02951109deea1513d44f00
SHA256

5eb4abb028c371d35a78248107350fa8739c36ecac3acf60859faa10564ce2d9
SHA512

80a677f34817afa0c697ca81d280cad5c9c943250dbc99f9e72a7c54787ac80b311b19659b0efeec3f6ffe8c201e3c82167ef9e340ae2d377f36227edaebb69f
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhh:6pWpUFpEhLfyBtPf50FWkFpPDze/qFss

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3568) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\SetStart.tiff.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\corner.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libau_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextService.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\de-DE\Sidebar.exe.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\DebugRestart.rar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\LICENSE.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\settings.js.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Pangnirtung.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.RSA.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\ucrtbase.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Manila.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sampler_zh_CN.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-actions.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montreal.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libantiflicker_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mac.css.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Utilities.v3.5.resources.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsvorepository_plugin.dll.tmp	3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3b33a83ef62695c82e2875d16de27200_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2988

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
Filesize
82KB

MD5
d931d88101fccffc6e734f9a6a024846

SHA1
7fd9f9b1b2747fff3d91c2682f74501f6f22bc4a

SHA256
9a9c4dddb1b6ed5deed91280815bc281deb14a3a8c530ba1145f3e29b0cb1acd

SHA512
785aaddb991c6ecc8f69097065ea1efc410ce2490d2235fde8b78ec5e8efc9ed659256eaeb9e568a13a7625cfc4575f3e8abd9d48539701bcbaa15af445a4a94

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
91KB

MD5
5ab087434f26fafa25bf2a61b88e9646

SHA1
a5d029b0245ccf66b19c6abf8d9966196c00729b

SHA256
a1ff9d1404fb755fb9f99ecb73b81cb8d2fc16fb5ded0fea6e36c4d62f898319

SHA512
7914d40de118587d557e74da217b9e52a0ff4b0b7484c4251027eaa673c129925d4538d5f9032d6631b7b0431dbb12833ba2640bae6a7afd86f0c5cfca41015d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads