Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:59
Static task
static1
Behavioral task
behavioral1
Sample
1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe
-
Size
76KB
-
MD5
1fffa93c50fc4ec509dc9871fc07eb00
-
SHA1
5c25484b7b0d98d602deda386732dd68cc127798
-
SHA256
0bbdfc4431e7b87cc02e641a3b0945254411ee09f571e28f0093fe91901ca1a5
-
SHA512
65848b107e319c8639eeeed3fc07f2a6145232b7284bd734b8afd4c243a3ad42e9e8203213629ce0d38ed5d0d654166ec96bf35cd19d7ec8f7a123ac9ce2c1e8
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhs:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsh
Malware Config
Signatures
-
Renames multiple (3733) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_ja_4.4.0.v20140623020002.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Denver.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\it-IT\ChkrRes.dll.mui.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\Genko_1.jtp.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\ja-JP\wmpnssui.dll.mui.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\wmpenc.exe.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_snow.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Novokuznetsk.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\ja-JP\setup_wm.exe.mui.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\attach.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_right.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\vdk150.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Conversion.v3.5.resources.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_rest.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbytools.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management-agent.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\wsdetect.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-threaddump.jar.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\Graph.jtp.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Metlakatla.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Adelaide.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libqsv_plugin.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\flyout.html.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\ja-JP\jnwmon.dll.mui.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_ButtonGraphic.png.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\pdmproxy100.dll.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen.tmp 1fffa93c50fc4ec509dc9871fc07eb00_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD58b887655822eb577cb47fa1d7e0682b9
SHA1fd25115f1d8daa43ccba093baea6f5d467a1f367
SHA256aa2ce8372a35c9dd2dc3946e8f2c5d05e4bfe350946f078eb0869240d447bd91
SHA5120598d67e69a3b961dbc1e687750661b4f2ffe9a53753cc874e97c44fcbeebce929013d01d6122713a7475e4716fd58d962e0c24e7f02517dade638d6783ab546
-
Filesize
86KB
MD542d0f64a66ac814b92bc6ab564b74281
SHA1c03ff269edcb6eaf13463fef1ccd6cd0c15c6259
SHA256277f3ecb1638bc39f7116967203e1547cefc15d225b1b5649707f973696eff36
SHA5122d8e12baac7d964123ad4e1a03b647e3fe1153bd8d898f5dc66e0ca9e72f8305c2ee4476fae967560ee81a608db5a7a75174cd9a9a9b3d17c0e08a58beb359a8