fd52cc691f77bf34b1f82775d6fe2824d552a60e31bd1dbabc4380c506e5b3a8

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-06-2024 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
Size

92KB
MD5

552ca5018553b17fcb2433b97be36400
SHA1

6091f7d0a0f7d90b77a299e54d73cfba13bf0797
SHA256

fd52cc691f77bf34b1f82775d6fe2824d552a60e31bd1dbabc4380c506e5b3a8
SHA512

66b072a0ce5bca0a6d25bbb1e6504b567ca60a34d0cbeb11bb85983e97adf46027cb86fb5371f852140479261fcb1269c3b100760cd77edd96c99fa1b515a505
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0Kj:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0Kj

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3436) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\calendar.css.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\vlc.mo.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.lnk.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\wabmig.exe.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-5.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guadalcanal.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\SecretST.TTF.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_ja.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mraut.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\JNWDRV.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\wmlaunch.exe.mui.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\tipresx.dll.mui.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\currency.js.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_zh_CN.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\gstreamer-lite.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_ja.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\HeartsMCE.lnk.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\es-ES\MSPVWCTL.DLL.mui.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac.tmp	552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\552ca5018553b17fcb2433b97be36400_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
93KB

MD5
6a81e32d204a079e3896d0d44e9ae59c

SHA1
a5d54a5e1642534c656096d574378473400ce2c8

SHA256
64dfa410e0407242fc4f3846ee5569500e193b26147f2a09b2b698617d7c2250

SHA512
d884299a5bdaaead6a0fe041a6e909eaf2db51ba0395db46b528fda7031d61542361cc8f0654e25a6bb91a2e1cd6ac314500781dc46091f080f07d395c5ecff0

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
102KB

MD5
cf742d5df6b043e3548ef2269c2abf50

SHA1
0996ff65419bf7751ba5e09f577096c4b155a924

SHA256
6f0ae5724aa1f94b6fbe2038ab836b05780a642bddc12168cd310dff4b239e2e

SHA512
e82553b7d96845ede3f4955d127c8ca284871ae3e4ff542767a9204c8e045a94549bab5891ac777fa20fa2ce3028be152a864b629f73ad3cac6535501229d28e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads