Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
-
Size
100KB
-
MD5
96e432b32e69329e6afa5b5919f85820
-
SHA1
395f3f6061d652d171c3bbbb08bb16f16294e3aa
-
SHA256
84f8044ea6e711434d08bc64c84c5bd1f62584331f292fb50ab89836bf5b2fcb
-
SHA512
3b7c75be6756c7208660920b06c41360c98631ebace4b9df3cd98cf9d5b68748433699ebb4e19bbc8c11a335edcb3fb8326de1f1527af147e26eeff09eeb8650
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/yJgJ1:6e7WpMaxeb0CYJ97lEYNR73e+eKZsC1
Malware Config
Signatures
-
Renames multiple (3435) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_zh_CN.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Mendoza.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libadjust_plugin.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2iexp.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\application.ini.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-nodes_ja.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsBase.resources.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\instrument.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\FlickLearningWizard.exe.mui.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\F12Resources.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dhaka.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Brisbane.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\modules\sandbox.luac.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kamchatka.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Oral.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libattachment_plugin.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp 96e432b32e69329e6afa5b5919f85820_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5b202fdf96bfe005596ae91c19d34e20e
SHA1c571ecb5640e38db946af326002ba6e278acfe8f
SHA25630469feb562877551adb493e44c143e756424c215e2d09d81728143138d5cc02
SHA512b51a30c39e7da83124b40dcd366ecdb1ed618210cbfd76c8ca15ef3041f0697df3fbca670b2d879371c3cb88d3cd4fe82407770144dde2c9a5491a6c684b24ef
-
Filesize
109KB
MD5ad4ba860dfe93571ed5f5879e19c61c6
SHA1584bef75184a3eb3a39a3dfa9a31f582d7f5e636
SHA2564e397921bbf2b7f5405f0eaa78f235da4d4bdd9a3cc2ab6f2bd91f326cdf18f3
SHA512b4697f0ec9ec6556270a1a12bc1fc7076fd2fdcd51eeaee01d9820fa2677262bd4a20e520f7f1e3d3842a8f7370c238452a88accde83821c65a6af4068212d42