d7c5b569e3fd8e2a01d874595a5c03b06a6377aa966d36bf2128d6e66e8b0c17

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
Size

75KB
MD5

5c97e1267129e664a5ecd987dabd1270
SHA1

e7344ce10b89cb983f5420c51d931c11c2b3d9e3
SHA256

d7c5b569e3fd8e2a01d874595a5c03b06a6377aa966d36bf2128d6e66e8b0c17
SHA512

6000fa89307812c0978d9ad8585b441c3d8997570441fd0d787312d7d10b84e3e75fdef96316f6fee734c0ca2b2b1f6207a06578eeef38ce6fb022535766313f
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHE:W7ZDpApYbWjIlE77ufL2e+efZwZ2y

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3725) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatialaudio_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\rollinghills.png.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro.nl_ja_4.4.0.v20140623020002.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\jfr\profile.jfc.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\FreeCell.exe.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libwebvtt_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\JNTFiltr.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+10.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base.nl_zh_4.4.0.v20140623020002.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\vlc.mo.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\mshwLatin.dll.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glass.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\MSOEURO.DLL.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Buenos_Aires.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\VISSHE.DLL.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsdec_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\ja-JP\WMPSideShowGadget.exe.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Moscow.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libnsc_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\Shorthand.jtp.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\management\jmxremote.password.template.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Khartoum.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kosrae.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\it-IT\setup_wm.exe.mui.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css.tmp	5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c97e1267129e664a5ecd987dabd1270_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
76KB

MD5
38e284d14cd5357f7ab2e4b0b0810168

SHA1
37ab3c5b450ba81e3623bf0209a1db4a24c61438

SHA256
9b9b32105ff8db5dc1d066edd0b5c7ac566b566b5117111b66e4875258647730

SHA512
3b60f824b2970ebab9c648d501c62fb63524396ed7517cdcedd0d2d17ea4c3561263de0554a5188155a46751788157a6a83021b2b2bc33b43880b9ac2aec8077

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
85KB

MD5
029868dfc0f5cf2a662183352ea81304

SHA1
1f5ddc0655e8c0fd01f0c26103390c658212db21

SHA256
d5770251bce0fe2298bdac9c220d14dd946aa29d8add2e84ae1a3692dc94a352

SHA512
3e95bc982b9aaf3f712a5f814bad0989e862907ff86168ebb67ea36591fd4366e97761e985546e03c2e1dc807775b75cfbbd99ae8ccace277d95d20ca825363a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads