53291171ee517551a22b6a136d8824645d677c65e70af319be64b24f867a0e8a

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
Size

73KB
MD5

6fa6caffe6a4afeddd2557573f70f240
SHA1

2631e71a3047183389aba79a9315a4281cfb4fc5
SHA256

53291171ee517551a22b6a136d8824645d677c65e70af319be64b24f867a0e8a
SHA512

6f5a4315634297e43fcec9bdd3409e7e3a75062ef580673c0d40f03fc0b56844fadc0f051063bf474b1db9af09daa3e898131a8ff9ca8a27b44114d7327d350a
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhY:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsl

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3521) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\libfile_logger_plugin.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcfr.dll.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_zh_4.4.0.v20140623020002.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Fakaofo.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.service.exsd.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-api_ja.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl-hot.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\zip.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\jsdbgui.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\cacerts.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\weather.js.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\it-IT\NBMapTIP.dll.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libpng_plugin.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\fr-FR\TableTextService.dll.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ashgabat.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libps_plugin.dll.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png.tmp	6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6fa6caffe6a4afeddd2557573f70f240_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
73KB

MD5
36c907b7fd7f986e9367341efd4b78be

SHA1
991933ac7d490fd46c8e8c6866a9f1c9892330f9

SHA256
5e579f9cdc33a3a48e380982cb5cabce3c86a3f1154a539c78ef193c02167e2b

SHA512
3ebfc0048157530aa100a6f5f46b7c6a23303410b093b7604414604de694f1fcba84a70c06dc2b0a77865739c115ce2e8608e31548c6379e32640fcda37c1f80

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
82KB

MD5
6fced3ec825f9fe08136cb6ef7370b21

SHA1
755cecfb8845f03dd7251a791b2bbf01a272b2a6

SHA256
8cf25848b9058e69e4a3b91bee4c41a9ebb4ccbcfec9e1383563b582ac131527

SHA512
f8ef4d19bac9388f689564882b9b144c1584f0de14e3cb7856094dc4a22a2b5574f5651163e156fd5b697e1c3dec3091ca6f033aba00c40e01b8770c86a4f35c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads