01b73deac1d759fcb0b7006d9724228029efa153838466d407bdd002371b54b4

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
Size

73KB
MD5

a962aed17025aaf6dadb6cd192030970
SHA1

3fc3d7c71c4ff34d0d285fe81579ba0fc5213bcd
SHA256

01b73deac1d759fcb0b7006d9724228029efa153838466d407bdd002371b54b4
SHA512

274aaebcbb6ca87999677edf586810ce7b60775ed0efcc91e2306c06afa3f6bbcdcbf053b28a0750b27b1ca96d6ff3314e0262910cfdc8f4567ea3212d193cf0
SSDEEP

1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69Q:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3764) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\PST8PDT.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libmediadirs_plugin.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\jnwppr.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Ushuaia.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\osclientcerts.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows NT\TableTextService\TableTextService.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-queries.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Windows.Presentation.resources.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\deploy.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnssui.dll.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcfr.dll.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_olv.css.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\security\javaws.policy.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thunder_Bay.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\sound.properties.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\settings.ini.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\TipBand.dll.mui.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\README.html.tmp	a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a962aed17025aaf6dadb6cd192030970_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

Filesize
74KB

MD5
6c750f878fcc658686e6b5cdc80ceb60

SHA1
4d32d0f27c731cf3868bec1c32d32771b9884323

SHA256
db0bcbaebd65b2fe243a5fe8858f0643d8269ac50095f3d8a786451a44118da8

SHA512
37c5e2c5000e4638c0a271580b3936b3b3fb3574d233625dbb96628b09a0e69e2d4a43b1587fe130a0643e415571c589f4024684544e192478218e939edd2118

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
83KB

MD5
5bfe33fcf4a2583ba22c7b64b6c93856

SHA1
66ad2cc84cbb0cab0f93de1fd47f9ef15f515434

SHA256
3cc455ed95683aa0a35ab07ad7339d2c24b95fcea24bb0efc590d612eb83b3a6

SHA512
10e47e1580ec97a9310a5c0a55302fba2c5a18b2c16fcbd8c172b8da0b271878adf4170019dd70c05d6b6062ab051aea0ec093823e6d4eb469883d4a29cbfb22

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads