993fafd8e389e3e5f7a379b3ddd0acd5da8ed08ef01ee4da5678aebc5684d595

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
Size

129KB
MD5

15a79681408c71d6aa288843d638d800
SHA1

cb5799db56f1e0d19e383512677463566526bc3a
SHA256

993fafd8e389e3e5f7a379b3ddd0acd5da8ed08ef01ee4da5678aebc5684d595
SHA512

577f08e500b539887c88b4a70fdb0775ef9df7f445a4ffeeeeedd57e04d8a7ff9ce70baeccde2512986aad9d009498121f722e4d5bd06a7a56fa2280d57f75c3
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzu:RqlIyFESWu0SWuGSwxB

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3430) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_dummy_plugin.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libaribcam_plugin.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ie\LC_MESSAGES\vlc.mo.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Knox.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\MpRTP.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\ssvagent.exe.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\vlc.mo.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcfr.dll.mui.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Pontianak.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.DataSetExtensions.Resources.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ja.pak.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Casablanca.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Palau.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\visualvm.conf.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jmx.xml.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.lnk.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_zh_CN.jar.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp	15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\15a79681408c71d6aa288843d638d800_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
129KB

MD5
496a80ce9e06cb2ddaaabf88fa1d1641

SHA1
2e6144c243ab8ae23de312cb4cb993c31ac05359

SHA256
a1abc8d08575e16c4b05cf105c1bb8d32d031fc6f9f0976912b967d9b299cb2a

SHA512
c7350c6228aace8035986c25f494ae844f1f64df69d3d50d7351bb9834eee9060bf05255fd68500ad836b368b3a44eb0452b73d9f77504e8f0342f4c8bb4d093

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
138KB

MD5
7e44a4091deae0c276a6926162187dfc

SHA1
104f2fea444119a9f935eaac35956912145dd018

SHA256
32905cfaeef76baa8ad67534099d6efa42628069592bac93918c6066c7250896

SHA512
f2957f08575623d9358d575b032623b7140cda1c54508e5506a770f30745a180c0d74ce6729f145d1c833e4a5d387a87fe63392f3fa006305cab6b143f8d391e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads