Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe
-
Size
73KB
-
MD5
81d12dbb020cf5d963cf2239ab75b020
-
SHA1
09e9abb6e16853105056724d368c6f9abcb19420
-
SHA256
42395c23f65936da324e0a404ec859cf59f41d7595c35bc7fc7c91c33a156ec3
-
SHA512
a65506b222f0f38e4c3d80719d929acd2619288093ca4eecf56da430a51c96b9b4a18c354676a26ec476459f27bcbfe30a42a2dd6a51e26e434971bfd03e743e
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJi:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfF3
Malware Config
Signatures
-
Renames multiple (3794) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre7\lib\deploy\messages_ko.properties.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_http_plugin.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\de-DE\setup_wm.exe.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\jsdbgui.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tirane.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Thule.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_mms_plugin.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ho_Chi_Minh.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\libarchive_plugin.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Mail\en-US\WinMail.exe.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\gadget.xml.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\gadget.xml.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\penjpn.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp 81d12dbb020cf5d963cf2239ab75b020_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5a98011b27b67963f25b34b4051859fce
SHA1ffe045ce40aa5ff50a40cfc1f72d01aaa75e5a46
SHA2566460d911f6fb929fda0d7fd1b70294bd2278533ab89ccb27c0209d9b92ca6896
SHA512ae753bee9d45366966238025281996bfa15698723c45607d4b54e3f8f77b32e46c19b8f224f02e149f8e563802091a94000c0b9a6e643f11aa14eef4fce88def
-
Filesize
83KB
MD578531e5297847a069346ed63dd7a3891
SHA18d7dcb2c25c9bf48fb802c391e50dc848068dfb5
SHA256e8729f71f76f62de2b7415f0789a08b920fca217992b23c8d78ef570ffaed54e
SHA51288c9b1fb72295cc699fcfe116a019e4a20fbdffca6f78eb30cc98a6d2cb229ab15a5dbe058e3fbf445b17cc81c51c4768b1fca4085c0f05ce1e72a0dbe7da3de