84f8044ea6e711434d08bc64c84c5bd1f62584331f292fb50ab89836bf5b2fcb

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
Size

100KB
MD5

96e432b32e69329e6afa5b5919f85820
SHA1

395f3f6061d652d171c3bbbb08bb16f16294e3aa
SHA256

84f8044ea6e711434d08bc64c84c5bd1f62584331f292fb50ab89836bf5b2fcb
SHA512

3b7c75be6756c7208660920b06c41360c98631ebace4b9df3cd98cf9d5b68748433699ebb4e19bbc8c11a335edcb3fb8326de1f1527af147e26eeff09eeb8650
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/yJgJ1:6e7WpMaxeb0CYJ97lEYNR73e+eKZsC1

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3435) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\instrument.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

Filesize
101KB

MD5
b202fdf96bfe005596ae91c19d34e20e

SHA1
c571ecb5640e38db946af326002ba6e278acfe8f

SHA256
30469feb562877551adb493e44c143e756424c215e2d09d81728143138d5cc02

SHA512
b51a30c39e7da83124b40dcd366ecdb1ed618210cbfd76c8ca15ef3041f0697df3fbca670b2d879371c3cb88d3cd4fe82407770144dde2c9a5491a6c684b24ef

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
109KB

MD5
ad4ba860dfe93571ed5f5879e19c61c6

SHA1
584bef75184a3eb3a39a3dfa9a31f582d7f5e636

SHA256
4e397921bbf2b7f5405f0eaa78f235da4d4bdd9a3cc2ab6f2bd91f326cdf18f3

SHA512
b4697f0ec9ec6556270a1a12bc1fc7076fd2fdcd51eeaee01d9820fa2677262bd4a20e520f7f1e3d3842a8f7370c238452a88accde83821c65a6af4068212d42

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads