Analysis
- max time kernel
150s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
29/05/2024, 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe
- Size 52KB
- Sample240529-pdg7maef49
- SHA256 6abec6e80f7ed011caa6c9432c15c77e43d0da29e951505447855555f83885ae
- MD5 531aa6425d2cc5047457aff4c2ae61e0
- SHA1 bb619f321b9a912d8d1ece7d8f83c6ed3ec79321
- SHA512 c7a4c34a60f3d4dc8a0294b2b3dd2e3e214005d3d61da2e5b56c94e2359b4751a01975802ba7cb8f04820800ce2373c97a55a215a3a5c11ef6e72dffc76dbd5a
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsAiKd5nViS:W7ZNLpApCZrt8PWGoPWG/dN1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (1031) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IpsMigrationPlugin.dll.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Chisinau.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\nb.txt.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Beirut.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Macau.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\handsafe.reg.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Perth.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\HideRevoke.xml.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipTsf.dll.mui.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Melbourne.tmp 531aa6425d2cc5047457aff4c2ae61e0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp
- Size 52KB
- SHA256 0e49d5a009ddec1859af6b9c0cae31f2b83542b8ece9c217e4601441a14808f0
- MD5 506b3c3b84ad626b9f48d29941256a25
- SHA1 46296bc8cc1e9e884661220326a974370fa9806c
- SHA512 e4060aa4993f3a5a740006bba194b23d68b0a733de5b4c2842797b069e3f44b0dfe844be684de79b38f381eb97c4df20d6f4016144314f9deb3850807bb2ff06
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsAiKd5nVie:W7ZNLpApCZrt8PWGoPWG/dNF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 61KB
- SHA256 260b5daf57cbf1974a2c2b7ceb820708ce2b79cd2ce636f8a27deaee37a57c9a
- MD5 4edfbcbcb4e5ab4b93216d150f02d823
- SHA1 cb2b8584c5f8c937cd34c87c63cfdf888c2bcd04
- SHA512 bab9cf52146e4a9fceade82f604b398e4a4d0626a76427b757bdfd9f42713aeb6079212c8638229930ef5634e15738d6edd97669f1803530e055aaef49ca0776
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsAiKd5nVidN1J3DCl4N1J3DCl9:W7ZNLpApCZrt8PWGoPWG/dNj
- MD5 SHA1 SHA512 SSDEEP