Analysis
- max time kernel
150s - max time network
120s - platform
windows7_x64 - resource
win7-20240611-en - resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 23:03
Behavioral task
behavioral1
Sample
8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe
- Size 145KB
- Sample240613-21nddathpd
- SHA256 d0b99f6ac2485565d8628e1b0cb78d01442c95df9077e46b6d27e6d4d71fc6e2
- MD5 8e7ddd8f077dab3451a6eb7cb7791780
- SHA1 321dc05c895a4a1ee2447d88d3e0928f9ea74cfb
- SHA512 c35e7932627d26c4a554b7ad9c8064ef8b2e9b0119226dd6fa10a8c21677f7b98ec291b6c7ddbe9d6163ad07f0aeebbd2fef6475c0e884b20ca03d7ca2bf5895
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC7:fnymCAIuZAIuYSMjoqtMHfhflixiS
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3459) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1572-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000e000000015f89-2.dat upx behavioral1/files/0x000b000000010623-6.dat upx behavioral1/memory/1572-654-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-tools_ja.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Eirunepe.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground.wmv.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Reykjavik.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\SplitFormat.ttc.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\wsdetect.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip.chm.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_ja_4.4.0.v20140623020002.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\unpack200.exe.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4ADT.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationClient.resources.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.RunTime.Serialization.Resources.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Guam.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Guatemala.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\MoreGames.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\browser\features\[email protected] 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libavi_plugin.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tabskb.dll.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Bissau.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\InkWatson.exe.mui.tmp 8e7ddd8f077dab3451a6eb7cb7791780_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1340930862-1405011213-2821322012-1000\desktop.ini.tmp
- Size 145KB
- SHA256 8cdcdc84db15d4dd85c16be6d0d6ea074f77c035a270cd26ea1ff4db21eb40ac
- MD5 a45ffddac65ca4125b859fa704b4ca6b
- SHA1 a3d5ee5a697b37262e9fc7a6b883dad92afa863b
- SHA512 577899c95cf22ad688c2e6e49cb4b3d9eff881204d8da38ffdcccca466889685fe6068312268c13986f974ebd76ce57fcf4fc576b43528df8cee3870c8130e6a
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCN:fnymCAIuZAIuYSMjoqtMHfhflixi8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 154KB
- SHA256 4f7e9d23d1cc548f7463fe854a61b7fcf0c3f2638f970d9135b9fcfcf8310ee0
- MD5 e254875c72738a00878875c53b55117c
- SHA1 ba154185beda6419e011366527b0088a2024962e
- SHA512 8b3907e68e1981e38681a67c6b35692a3d8308d959b2d17b59eeea6cc99d4fd962e3c44d11718ba3335747d8d8d5a42cd63743d72bfa732f822b4395d8b1874d
- SSDEEP 1536:V7Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSC2:fnymCAIuZAIuYSMjoqtMHfhflixiv
- MD5 SHA1 SHA512 SSDEEP