Analysis
- max time kernel
150s - max time network
123s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
13/06/2024, 07:53
Behavioral task
behavioral1
Sample
6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe
- Size 63KB
- Sample240613-jrcleatfpn
- SHA256 824164c95c4a311b0fcfb21a0463f0de6b3cdd75c31f85d07499a4feb3bc10c8
- MD5 6aac4c6812f2e2cc7707d8c39f9c1df0
- SHA1 f9fd2d3f97fb7f8408ada9b858f7e842a1a6aa09
- SHA512 a78865a9b74a40f70db101f3417689ae35c6898666d75e3abebb3c58e95e15409bc20890b605d5abbe11301f369aeda6044bcca7fe2af02741d8e11bd1e0d037
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8YXdXk:KQSohsUsxe+erZs1o8k1o8YtU
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (3544) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/2064-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/files/0x000c00000001225d-2.dat upx behavioral1/files/0x0002000000010679-6.dat upx behavioral1/memory/2064-74-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\ext\dnsns.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Apia.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uk.txt.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\jli.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\ssv.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\jamendo.luac.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libfluidsynth_plugin.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4.ssl_1.0.0.v20140827-1444.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\GetRegister.otf.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Krasnoyarsk.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Australia\Darwin.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\ja-JP\SpiderSolitaire.exe.mui.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kathmandu.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\micaut.dll.mui.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Jujuy.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\net.properties.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Eirunepe.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\updater.ini.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_ts_plugin.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe File created C:\Program Files\Windows NT\Accessories\WordpadFilter.dll.tmp 6aac4c6812f2e2cc7707d8c39f9c1df0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp
- Size 64KB
- SHA256 ad771b7ae89f55da45d7d885b58bd425f58cb9d2fdcc307a9cea403eb90ac297
- MD5 14be66dbd42dbee52e9ad0e392edd7c6
- SHA1 20dc4e37715ecf7bf7f890c4d51e6a5fa6121a83
- SHA512 b07a8023daa5c880d3952a98a8db083f255e0893b6a2c0f07bc1127a52f26896b1676d0875a569ca98cb38a2564309b96bedcec5794ae387e6cbd417e4649737
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8YXdXT:KQSohsUsxe+erZs1o8k1o8Ytj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
- Size 73KB
- SHA256 128616e0a95fd78912307c6948c60d81e39bdc6fc56d9408f784eb31ef81ffd9
- MD5 5fd804aa5032c5a27d00fd730a81d030
- SHA1 6b66e7dd8095b1f501acec5610df3dac7789d16c
- SHA512 c698a287412903324324d41feb7f96d8df607d1680bf73cebe0c743b25f8ee10845bd20c08316b9bb53a78c96a6b0182ea32728deb9ba6d1d023fb343f9e2795
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsxe+eX7n97ns1o8k1o8YXdXn:KQSohsUsxe+erZs1o8k1o8Yt3
- MD5 SHA1 SHA512 SSDEEP