Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 01:09
Static task
static1
Behavioral task
behavioral1
Sample
52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe
-
Size
95KB
-
MD5
52a5697ca490d084e2fd65912a926310
-
SHA1
58d346e4a8680c1001936302c42496c823ff2ded
-
SHA256
5817afa1e63a6c1a349fbb716af9f46906eec2186e15ec65e5816f7094f4aa3a
-
SHA512
83cbc41470b4ec0301a6b94f70791c4eb5e4e615b476ac870fbd6db5b9bdaf9487c4a924c678211fd1d8f591fef05d8485f60c447d963ccc397a576cbb1bc0c3
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Waa1aar8p:6e7WpMaxeb0CYJ97lEYNR73e+eKZWaa0
Malware Config
Signatures
-
Renames multiple (3423) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\vlc.mo.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libzvbi_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-remote.xml.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\shvlzm.exe.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationLeft_SelectionSubpicture.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_ja.jar.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Ceuta.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libtextst_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Brussels.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-spi-quicksearch.jar.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libmpc_plugin.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Martinique.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\PhotoBase.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows NT\Accessories\de-DE\wordpad.exe.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kabul.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\library.js.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_right.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\wab32res.dll.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\curtains.png.tmp 52a5697ca490d084e2fd65912a926310_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmpFilesize
96KB
MD5fe08ec010595fa0dd20acf73f3b13cb1
SHA106926fd7838d5066a7ff9e73d618c7dcaf0e233d
SHA256753cf08eff67332ce02a524ae7eaf0c9c18c8be4633d04373cc86c0bf6ec6b62
SHA5128979fcaec957cd19dece34c1d6ccbca29255f28f6cdd260cc4806c364593e510daf2a8c57ef51a0408e0497e382c56e9872f73a495e269bd3713d54a1a8348ba
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
104KB
MD5517eb1e69f9db43e966dbd8e6be247c1
SHA10fda9e3fc68bb1217855908ee091288faf4ef764
SHA256281fb48f5dda44c297b6e64e5aea82c0e16929bd82d5fa9212353b6eea2f9c60
SHA512125025d3e3ac2dd6505f81ba62e433bfc5e494ff67bbc4b838ffdfaa414746d2c74eb070a9a63bf09d2ba2a995f6a651b390aa34d96130fbf06e09f2a2a47fe9