381dac1fd7bf2ec8ef7f22eb50553b06c8faf2efa7b1910095de15580552314d

Resubmissions

01/06/2024, 11:55

240601-n3e8wsce36 9

01/06/2024, 11:53

240601-n2ldhscd95 9

01/06/2024, 11:50

240601-nzzs5acd62 9

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
Size

95KB
MD5

6a3fa042f98c5e544498061ab114ad00
SHA1

c1993ed23957cb7ccaeab0ca9d8350fc14e417c5
SHA256

381dac1fd7bf2ec8ef7f22eb50553b06c8faf2efa7b1910095de15580552314d
SHA512

13ad88338f4c207374bddd0f227dfa0b9b33596a1f96e0c3143e3840fd2d3d73a1837bbac2ec6b628b0a1f6ae76e54e5c63f94cfd4e170f7c3ce5199cd6eddc7
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Waa1aar89JAJ4:6e7WpMaxeb0CYJ97lEYNR73e+eKZWaaO

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (593) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\rtscom.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sk.pak.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\whitemenu.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\mlib_image.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
95KB

MD5
376df14b04457bfcb3749a587c8f0e98

SHA1
5c9a29262056c35547c03d2da2021f94dbc33e4a

SHA256
347259c67d3d4fa2994b98a2e6d71c9538fc71493e768ab017cc7e2f7dea7ded

SHA512
1b22ac261fa007dc93bbfacda5c1cae124eb6f18a9f10048095ec502f82fd85c0310f342833863a75ce6be698786d1ac5915f85d083856d9ba05f13c4eb1b532

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
104KB

MD5
42f21a1eaf523efa238b6b0a73d66da5

SHA1
7e33ea95e4ae4bcdc872721d8e4f66c0f21ec8b6

SHA256
d59ff4c9636ffe2d539b18ca324f3035f35fc1d47ffa7a929ba36a531b09ebed

SHA512
134ade7d39de067575295c8a08e27db3430026e8ba0a945a694e1138c85f848c2febaddc8a0d87a8c744c3d2e76f646dd6ca8d35400888e8d0c11e1954f16128

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads