Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/06/2024, 11:55
240601-n3e8wsce36 901/06/2024, 11:53
240601-n2ldhscd95 901/06/2024, 11:50
240601-nzzs5acd62 9Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/06/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
-
Size
95KB
-
MD5
6a3fa042f98c5e544498061ab114ad00
-
SHA1
c1993ed23957cb7ccaeab0ca9d8350fc14e417c5
-
SHA256
381dac1fd7bf2ec8ef7f22eb50553b06c8faf2efa7b1910095de15580552314d
-
SHA512
13ad88338f4c207374bddd0f227dfa0b9b33596a1f96e0c3143e3840fd2d3d73a1837bbac2ec6b628b0a1f6ae76e54e5c63f94cfd4e170f7c3ce5199cd6eddc7
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Waa1aar89JAJ4:6e7WpMaxeb0CYJ97lEYNR73e+eKZWaaO
Malware Config
Signatures
-
Renames multiple (3459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\zi\America\Dawson.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_ButtonGraphic.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ieproxy.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\calendars.properties.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dts_plugin.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightRegular.ttf.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libflacsys_plugin.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt_0.11.101.v20140818-1343.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jsoundds.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\service.js.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_es.properties.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Copenhagen.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_basestyle.css.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\jfluid-server.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\eula.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\splashscreen.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\omni.ja.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\nss3.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\jnwdui.dll.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp 6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:620
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1640
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5ae1b5300699f0ce5e6ecd21e6f0b359d
SHA1aec0b7bcfebf50d10b653dac84f619376e1e5823
SHA256eb93eabce58549ef2d36f6f1eb2a58f3da1a40329cce749c923d109271cc329a
SHA512595ba2a66530a64c6865bf0a4b97579e7fa64764d1d46a425a17c691648af12b52659cd810e8d3243d7dc20f8a68d081dbe82380bd63c1abf4ce2fc4249f907c
-
Filesize
104KB
MD5bcf6bf23e246c100f17fb28f51a1d9e6
SHA13a722b0fc21a1d99e07bac9ac76c6bb9a600f5e6
SHA2567cd1ea36ed05aac284b07739fd0da90bc277f41a09fa992aeef3e0c99c8e7172
SHA512a94048775a2f559317d2ee947842bea41dbda7639430207e7169199b0e171031c80423549bcc7e791ab976c4056501e2ccc0cf8d76a4d374e4e7cdf30213c58b