7b270903c1fb1c8d758036850c08810cc700b7c51aa272dcceb241dfde5af11a

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
Size

54KB
MD5

2fe226827ea5b502d639977a1161b060
SHA1

3452720dfd7177a7c49d2f4751187d7322c69fbb
SHA256

7b270903c1fb1c8d758036850c08810cc700b7c51aa272dcceb241dfde5af11a
SHA512

c34df4c35e4021fc0de5ddcd056acda9b408ef83efea34b9c0e62926cead28c66a5787b605c6596a9879fb2a7d4993ad7e4180316cac273e64b076a336b80106
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nezA8JQ2AdJCzA8JQ2AdJd:W7ZNLpApCZrt8PWGoPWGANdNx

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3759) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-progress-ui.xml.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\application.ini.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\settings.css.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Selectors.Resources.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\1047x576black.png.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_description_plugin.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Currie.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Resources.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-plaf.xml.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-utilities.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Mail\MSOERES.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ShapeCollector.exe.mui.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\clearkey.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_zh_4.4.0.v20140623020002.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jawt_md.h.tmp	2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2fe226827ea5b502d639977a1161b060_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
55KB

MD5
2d5c7f5a27d86229039c8f9006accf8c

SHA1
b16363add0600d3a0a4d2fe6608ca4a0ef595519

SHA256
42366b59d3f1368aab482acfd2a45ef2196093d36e429e8633c289001aac596d

SHA512
4bedb4334b252c78a8ba5ed8fd6d1c4956104c26c8f18381f2bc1fbed9c40f5a5b7591ceee955ef01c9ee75b322d903e82e0e0bb93137faf46e2afd877143be3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
63KB

MD5
441ab05d5f9a0db8b9eb5cf5057efc35

SHA1
67a1153ad80d027eac71aa5909d11732a1cb22b2

SHA256
ae388808b98cdb6f323c18c8bd049c6811e1382be42aba8dd79315779bea986e

SHA512
6aa348224cef05b4fd2060e33ff91625c39b0cb26547af003edb9d4679bba03498a64c6e998c770d5827a2ee75ba058aeca8f643578b9884c21c6544f1c17b18

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads