Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 03:50
Static task
static1
Behavioral task
behavioral1
Sample
9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe
-
Size
74KB
-
MD5
9ff6db7f6c65781f7bf852cc779ba800
-
SHA1
7d9a1c2c23e9a7f225683e96adefceb594339fa2
-
SHA256
ce0fb52106c19f407d25f55ae22e1e670eb534fa937b2385d91a5013e599aba1
-
SHA512
8212012652142c5db8982dd9e8d74c7d138779c691c6db6216c40aa97d1a23260d1f5679be414dca3ba8cd68355dcfc589d1b2e709940517eabaee34c983d070
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhO:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsT
Malware Config
Signatures
-
Renames multiple (3686) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exedescription ioc process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\Timeline_is.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mahe.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_ja.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Minesweeper\en-US\Minesweeper.exe.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Web.Entity.Design.Resources.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado26.tlb.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.RSD.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\hprof.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Design.Resources.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\de-DE\WMM2CLIP.dll.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\vlc.mo.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\ja-JP\wmplayer.exe.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\ja-JP\Journal.exe.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\cli.luac.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.forms.nl_zh_4.4.0.v20140623020002.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\npt.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseover.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-gibbous_partly-cloudy.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdirectory_demux_plugin.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\es-ES\PhotoAcq.dll.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\performance.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkObj.dll.mui.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html.tmp 9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmpFilesize
75KB
MD5d5cdd1210d01a12c833ad431e82db3fb
SHA19b4e0b2e97b6861752b97855e5ec8545b845d645
SHA256ecc34c726cfab86b0c78da1566472b7d076b3125230e4655b3fa4bbf0c248060
SHA51203d45bfe91eb638900aa70771e308987162a519cb86c84aa6848a4e059494ac649e7d591bf4c6d383a11470808c66192081692899961cc2806c79e46a910133f
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
84KB
MD50f8c35fcad9f52ee968474bcd2dbb915
SHA1a1a79142ee1b15e57c57eccc7171df08d55d6297
SHA256fb39e5f8c0be998363a35156e768043d674ddd711dbb6d9dd7bb134ed4163199
SHA512325278d0bfed5e875257f133c9ab69f6ed702fd685cbb07645ee07f9e3c4bed8bf91f3aabccb724043512ffc322a2ab6758c77953a55bbed08477c15f50a1f7a