Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 03:52
Behavioral task
behavioral1
Sample
89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe
-
Size
198KB
-
MD5
89766a2b7fa79503419eeca699ba5740
-
SHA1
da087144fbffd9084ceba7d80f2a523579179d01
-
SHA256
0215f5b768f6cf46004bf051390d9cfcc4a8150102169b52ab97380c838e4f6a
-
SHA512
3f36399bcb287fbc443e6702900a18154f9b15a46c5f15cb5028f8f3e33cfa3e2fe2fd56682b6d892a5782df2fb4ddfee0d33530b8f3a1a19fed03f6873fa4b6
-
SSDEEP
1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCR:fnymCAIuZAIuYSMjoqtMHfhfagqYje
Malware Config
Signatures
-
Renames multiple (3176) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1728-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000c000000015cd2-2.dat upx behavioral1/files/0x0002000000010679-6.dat upx behavioral1/memory/1728-526-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\cacerts.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator.nl_ja_4.4.0.v20140623020002.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.properties.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\es-ES\DVDMaker.exe.mui.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\libidummy_plugin.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudio_format_plugin.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Sydney.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\1033\MAPISHELLR.DLL.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Resources.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.rcp_4.3.100.v20141007-2301.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro_5.5.0.165303.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Purble Place\fr-FR\PurblePlace.exe.mui.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo.bat.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\nl.txt.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Taipei.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libstereo_widen_plugin.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\reader\filename.luac.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libparam_eq_plugin.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Sydney.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bogota.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\Palmer.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp 89766a2b7fa79503419eeca699ba5740_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
199KB
MD58ceeb2171c5df7f64af3358299b2907d
SHA130fb720b47c5d453ce73dd9b47add43ba17cfa80
SHA25618509ffc17db3a5a91a922b6f58b99857400bb281e610141bea5f207424319b1
SHA512b4c6eca4eb93f8ea4fa69caaee2875998f056c63cab6519d4ad57bb2722b5ed7f54d26e53313fcb36fe01c1b2189534dba196de41ef3afc7634248583802f3fe
-
Filesize
208KB
MD5468c44cf237e49b5cd8a41baec208f76
SHA1a440e70324621254d4b310d4ce511f737e3a05b2
SHA25687d65918ff23c9af2e0acd86fa931527c54c9877d310392dcfeaddaf0220ab8b
SHA5127a873e977727e60915fc385bbd3e5f1473a0976cf5df33df2e0804976155323a02fd76c3404d2e59bab444e75c53b30368e2305e2d97f61f5f0accf9d9958e45