0db84f5a54b0d7188e91491fa9aba3c660ad9bcf3404507036e4503b994fe6dd

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
Size

92KB
MD5

18020b7958b5ce28c7e41ac62d595f30
SHA1

b6c71317c0247d5cc10d2d41c5227af55eea72dc
SHA256

0db84f5a54b0d7188e91491fa9aba3c660ad9bcf3404507036e4503b994fe6dd
SHA512

fa2a70e63f8dbe28982c910f937562622cf77ad4e2f3a478a96e4d41a4ecfff3e5106780f3f8267a5cbfa52b2fa4141003e2fab7b3946876cc9154cf608a82ac
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN0U6PG0PGB:6rWpcOPxPke+e3fFpsJOfFpsJbgEmPx6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tabskb.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Athens.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Magadan.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\MSPVWCTL.DLL.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Xml.Linq.Resources.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPDMCCore.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\tzmappings.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ko.properties.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\de-DE\Minesweeper.exe.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsvcdsub_plugin.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\userContent_16x9_imagemask.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_ButtonGraphic.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcfr.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-nodes.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationProvider.resources.dll.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.sat4j.core_2.3.5.v201308161310.jar.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\rtscom.dll.mui.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\uk.pak.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Monticello.tmp	18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18020b7958b5ce28c7e41ac62d595f30_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
92KB

MD5
836e135120e97534b597cf3c35bd7a7a

SHA1
9be819be4061d16dc56a6db09874cb191d768ff4

SHA256
ab81226935815bfb323133a5152b6637cc87980e8014384bc4b2ab0396705e81

SHA512
ede5f45a298e00f6b27ce2bb846148968840e0b89d17cca795a70532551587334c4ae6c1c09280822dae49d85c978a1735ac7c16b203049e266a50d3b8a01eed

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
101KB

MD5
9e8f0b0a25c07a4eb18ced4139dff45e

SHA1
ee2d3d0a5297566a7bce076483ba17f515bccb62

SHA256
bbff983efba121ae5d0359e5edd9cd2f91c4407a6cd203c872182fd4d60b2d65

SHA512
5a2b73c3b31d4c4da30e3645851f489b27261828db43238e96d89be5ad8973b8a22ea042ffa7327ea1804f884637058f322b346cf82cb5cfae542f3fc22319d5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads