Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe
-
Size
46KB
-
MD5
80672aeb9acf2d4a3cbf66be481f39f0
-
SHA1
473905ce6cf7256d2e1220c6dc687f60ff7f3969
-
SHA256
b95ca2adf5b966c0471262b8f9fe3b9740bc0461d7fc92f053d0cb62f4a15823
-
SHA512
3a48249e07f3229b16361076584372476ddf40a398e7e4700a4aac849ab2c03a1994ce492fbad03993c334a3841ffba651a50ab74412f9eb3a59d957f74b9532
-
SSDEEP
768:W7BlpNLpARFbhblkYlkrt8PWGoPWGBJ0CJ0z:W7ZNLpApCZrt8PWGoPWGBJ0CJ0z
Malware Config
Signatures
-
Renames multiple (3762) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_ja.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libx265_plugin.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\gu.pak.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler_ja.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\vlc.mo.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.JPG.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\jfr.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\DvdTransform.fx.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-8.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\skins\default.vlt.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\License.txt.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\prism-d3d.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Sao_Paulo.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\HST.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\THANKS.txt.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_wasapi_plugin.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ur.pak.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp 80672aeb9acf2d4a3cbf66be481f39f0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5c124294ef07335e116e5fee1a5a78fef
SHA10929fc04e4f2affbcc6fce382962de9467bd0217
SHA256dd5434b92487fa6150f17c68f0b54e0ff8b4de6fc85b0daf8d9990fc452e83ba
SHA51226f2ae5cb074869bc6cb9ce26e4dcaed70c96af441979463547fb2dc6ad22de40ab125d4d2bae364b4ee2edf92c65ffd281b8557521cc8e943429749f374175f
-
Filesize
55KB
MD5638dd072a696f28f71d4a55b261bfa98
SHA165433e9a7f6649b65d38f82b75a02c6a8b3785e7
SHA256998c6fd4921a6f93cbda74469061b54dfdb5cbeb732b3c22f621313716f401fa
SHA51226ba37badc1eb24a0eae167acaaa58687f6168db47b67a3958a2a55fe10f04c06212790ae6bba58b5dff908e3e34908e8607264414bd79e02b3aabaf25ae0e5a