Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-06-2024 12:05
Static task
static1
Behavioral task
behavioral1
Sample
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
-
Size
78KB
-
MD5
394bcf9d882a3033a05c141918bf6b30
-
SHA1
8e4bcdc061becb7e96bc2d703262eef91dea5771
-
SHA256
cf81fca239fbccfcac1cb95d68db3e8cb45ffaf627b0c00db702955a16fea02d
-
SHA512
0e623739fa8062b02154b80b4f985b1210e73538a87acc324c1ac7086034f5645d1c0b000958b37b506d5cab6617ca250ff97924d8456dd61e913330c372f51b
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhP:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsG
Malware Config
Signatures
-
Renames multiple (3612) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\shvlzm.exe.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\pt_PT\LC_MESSAGES\vlc.mo.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annots.api.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\META-INF\MANIFEST.MF.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\trash.gif.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sitka.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\deploy\messages_zh_TW.properties.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Faroe.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\tnameserv.exe.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\settings.js.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\weather.html.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\MpClient.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\vcruntime140.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_ja.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Bermuda.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\settings.css.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\settings.html.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\tipresx.dll.mui.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\mlib_image.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Belem.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\localizedStrings.js.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\Genko_1.jtp.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_partly-cloudy.png.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp 394bcf9d882a3033a05c141918bf6b30_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5f35cf0aa46320cbb224adf11e2a75776
SHA128ac0508dff250182466848ac0232edce24307c4
SHA25666deeb2936f2f365fe542dd9659c5faca669f4a5366e997655850283858cf367
SHA5126182c59c833ad73c4dcb0ac76cdd581378d5d5d50cfc41fe30a471739cf8c30df46b6d2c38925ab1af8d0aace68a0a343e9bf725df8e79a07a1bf0ce8159f06d
-
Filesize
87KB
MD5b678033e000a22488108c08ad788dc38
SHA1ff1b115e47917bb3866205e897eeaedf6b8ed560
SHA2565b6f513a6ea868412e64cbb1e8ac6b95ed281530ff1fdd00396744ac2b74f472
SHA512c560c385d8b1c818b697b475a3d4cc96d69d49fe402a7e79dd095315ca424ce582e254eaa7f9c9e2e412520ad19840e67c1dedaca41273150fc06171c85e2613