Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 04:08
Static task
static1
Behavioral task
behavioral1
Sample
a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
-
Size
79KB
-
MD5
a118bbcd44222d7e2d707a598e68fc40
-
SHA1
01ea9bc9ce6b1b7bb8969f5c381beb1d8aae436c
-
SHA256
7b76219711e1c48550ba4fc5cd995cf353ca6aab28e7f81ce88303a229acd47a
-
SHA512
c90956f461c5acc5f8bcfde39f6e5bdafb390037bdc9822d4ba83dc8631c96b05c91bcc7b9b460841e5be4c562e93caf22b8c718021c1d2a785b6d1886bdac27
-
SSDEEP
1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tw0A0v:6e7WpP9oVLQthbYY9oVLQthbUrt7tw0j
Malware Config
Signatures
-
Renames multiple (3439) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exedescription ioc process File created C:\Program Files\DVD Maker\fr-FR\WMM2CLIP.dll.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Casey.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Norfolk.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\jawt.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Boa_Vista.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\tipresx.dll.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Lagos.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ust-Nera.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\dependentlibs.list.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\librv32_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\es-ES\wmpnscfg.exe.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Gambier.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Amsterdam.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IO.Log.Resources.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\vlc.mo.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgzm.exe.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmirror_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\js\timeZones.js.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\Cordoba.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\settings.js.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmpFilesize
79KB
MD5f89046a17a6977001c306f5705ce90ba
SHA1e331da8015e1edf2b7b914ceaf46c83e5189277f
SHA256b4ae73f52884d82cd0fa168aefaea28348f01280f345f4acee12274fa933890a
SHA5128fce61cf28c2f1e80f4443ff39e1c35e3adecbb7660a3eff1099011f5153af6a0206d0daebd9fc8fb0231ecace5b2b7179a5cfb0c34753ecc9803c60dbc0b987
-
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmpFilesize
88KB
MD5fe990a052b5f988b32d69cb1a0bafa2b
SHA155ced9101c7ff5148420a84a1829fbf73dc3459d
SHA2562b4c1e8d4b73f84f52c55755717c1e84ce8dd621c34b6fc46b633272d180c619
SHA51247ea1663780aaf5d55360cd76a361f25f9e3d240f2047e0a37bf9ad930298ecddf2c1ecefe48a14fbcea2e902d087e552cbfd706aab717d4ef84221d71cc242f