3691017818d6503e6f7ce2f9fed4b03e4f506484048749c77e680a82ea06b2ce

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
Size

44KB
MD5

4ba1420815bd5eab2e4236543ae75d30
SHA1

72a2f1a854d54d64282e054943caa90166c0dd73
SHA256

3691017818d6503e6f7ce2f9fed4b03e4f506484048749c77e680a82ea06b2ce
SHA512

cceba897eb4da3aeaa6970d5a098633094fac07705542a52012710aa3a29f73c1986a14c93a587e2985f44b05067a782a84fc0530a087bf764a8a9160d7d5336
SSDEEP

384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDk:W7BlpNLpARFbhblkYlkuvIYFWcDYcDk

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3543) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_imem_plugin.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable_1.4.1.v20140210-1835.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\management.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_ja.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Novosibirsk.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\Hearts.exe.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Vladivostok.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\slideShow.css.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_srt_plugin.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zG.exe.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libttml_plugin.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util_1.7.0.v201011041433.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Entity.Design.Resources.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\vlc.mo.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Mozilla Firefox\freebl3.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\AssertCompare.php.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+12.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\PhotoAcq.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EET.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\micaut.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Denver.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pohnpei.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPDMCCore.dll.mui.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vulkan-1.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Accra.tmp	4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4ba1420815bd5eab2e4236543ae75d30_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
45KB

MD5
5efdfbf61c2302134477501a5c1e70a3

SHA1
ca7670aff0c0600f1b2a2825028a794f78d290c9

SHA256
0808f0c185b61b097ed48128fb90d69f9c4c32a415ebc84e8229d0e6cc43a027

SHA512
5aa28ddbc696ab04d9dff23a2c4782d791f582134573593fbe31a09605bad838c6d35459906411b1d8bc188448cb76f4db493bb7ef063e30d1ff2824ffdc0ce2

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
53KB

MD5
7c8ea241a1ea4b592c222200c1c732ce

SHA1
ea6d8bca1fcad31d2dcf5ab78ba9d3e73828eeaf

SHA256
f3aefc1efd15a4066286bdc156f34599d912756e35c199d8237cd737a528ac34

SHA512
aaade9946f6360798c3a7a3468ef7cb7cb84c17c1338a2e4161e1cc520c3fe48b3b4ae5c5911c7fab318516c30d1ba0e7d62939abb2e687afd426315e528c2b9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads