Analysis
- max time kernel
150s - max time network
120s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
03/06/2024, 12:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe
- Size 53KB
- Sample240603-p14n5sgd33
- SHA256 9bdae5bab3d7e6084a4fef88ca275c375bd27f05a1def22124ecdb17dd50bf5b
- MD5 a3f831cb2547ad2042e01ae88e6bdb60
- SHA1 6b040ac7ba3e362a4e31f90d123c616d0c529071
- SHA512 7033f0290f062ff42164178d7cc0f38f910608fc69fd007a12c35c79f7e4de19d178788a3ef771df1a6763ee8c17051b28abe8aec8ad48475a8c7ed2f00c2c73
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nY:W7ZNLpApCZrt8PWGoPWGANdNY
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3729) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.properties.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_zh_CN.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1250.TXT.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.change_2.10.0.v20140901-1043.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DVA.api.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\jconsole.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\com.jrockit.mc.console.ui.notification_contexts.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\fr-FR\chkrzm.exe.mui.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Nassau.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\application.ini.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.ths.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Niue.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui_5.5.0.165303.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\blank.jtp.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Minesweeper\fr-FR\Minesweeper.exe.mui.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libtdummy_plugin.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\fxplugins.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_rainy.png.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Kiev.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libgain_plugin.dll.tmp a3f831cb2547ad2042e01ae88e6bdb60_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp
- Size 53KB
- SHA256 517d64d5677bcec6a703494a5fa8e443bdd110a8dcc44ba19186a510f14768e2
- MD5 d92a5cca006dcd742323a146e10a1f99
- SHA1 b0a0fab9c5c4491abd0cf985cadb74bdfff88ba0
- SHA512 e6f23da5391db9b8fb5a1763365a6c59fe35356e8f4b8eadb24e5b768568afd67eb5950933544f1ee70612bbbe65f04184a061a13a5436bc1f1e17f18a724fb8
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nQ:W7ZNLpApCZrt8PWGoPWGANdNQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 62KB
- SHA256 c6ffaefa4541c602460ead08a40b2eb0480824b4169042f836ef30bfb6617095
- MD5 75693d6459b111cbcfb950204f97798e
- SHA1 519d9f370c473443c74782c105fc5a3fb9050bfe
- SHA512 3ed781c748ec76196d97d6023f6fba8ef569f9cb54b5f3111950afd3ee1dd1e330aa7054228604104604831a6e0cc702ef61ed385a294b95888aadd657ca0ce5
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nwN1J3DCl4N1J3DCln:W7ZNLpApCZrt8PWGoPWGANdNr
- MD5 SHA1 SHA512 SSDEEP