56cc719336b43a450ffc9ef9d7180336886b03916a5a9d97c0ac64a4e98fed63

General

Target

5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
Size

81KB
MD5

5155a780a9358c297237a95cc8151b90
SHA1

d1be0ca824c24cc5608bd303f724400fbbbbd24a
SHA256

56cc719336b43a450ffc9ef9d7180336886b03916a5a9d97c0ac64a4e98fed63
SHA512

98aa37c0ee13fbf96f9968808e16951a3dd347a0604e0d52b7ec7278d83fc641dbab8fc3b4406ca055cc6281aef82f93c7f47df6d2a417920a64bb3e745ff570
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEht:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsM

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.sig.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_mmx_plugin.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ShapeCollector.exe.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\rtscom.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerConstraints.exsd.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\common.js.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_smem_plugin.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\ChkrRes.dll.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Oslo.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\EST5.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\fr-FR\NBMapTIP.dll.mui.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Salta.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\rjmx.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\settings.js.tmp	5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5155a780a9358c297237a95cc8151b90_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1520

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp
Filesize
81KB

MD5
8f6c0acf74d97bf9fd5ab3780315338f

SHA1
36d11cf6c95c2f43c9c722185e93590b2e1b82bc

SHA256
6299fac290ce67ecab7a5dee4bf6d44a9a6ac2bde869005184655d4e69df37f3

SHA512
2fbde53bd91e55c1b796d066d8bf91b3e04b9f0ce5f07280fee327decc93b82993d6bde9f387faae7e2f00f591f3047a9b7c96dbbf1e41de2cbda6c42a305fa2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
90KB

MD5
e0d33f91a6bf981ed7be7174ab8f0ec5

SHA1
68bfbb8ad4d3f38c3f659f52f556b1d37349a29e

SHA256
082125ab35dea4e684726d1a31a66bbf32ba788004d25231ad82d106625d68a1

SHA512
23288e9e1d24afbc13866ebcb7390c09cf29e09bcff6661400c3b847bafb26da401469a2508c8ec7906154d2b6066ecf631b35f41b35ad48d44d6d476a76cb2d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads