Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 05:43
Behavioral task
behavioral1
Sample
da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe
-
Size
59KB
-
MD5
da0288aa5455216d53cacc8e1e2ba570
-
SHA1
13a965e9e1853895d3b9374a793de6ed374cee87
-
SHA256
f44d5fe798ba5525729ff6d2b7263488fdd18524881894cc4b421f3cf0caf0cd
-
SHA512
8206b2a0ab9a944fc3432c3e15479fff3be847e9c17de2347058bef6052dfb609c83e1899c1304f0aa4ed231675878a1cbf6503cabf73c8dd9c75715da929cb0
-
SSDEEP
1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsTq5q9BVI2Ir:KQSohsUsWU9BK3r
Malware Config
Signatures
-
Renames multiple (3684) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
resource yara_rule behavioral1/memory/2268-0-0x0000000000400000-0x000000000040A000-memory.dmp upx C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp upx C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp upx behavioral1/memory/2268-86-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\new-trigger-wiz.gif.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\mojo_core.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuala_Lumpur.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\da.txt.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-util-enumerations_zh_CN.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\fr-FR\bckgzm.exe.mui.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\api-ms-win-crt-conio-l1-1-0.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\jnwppr.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\settings.js.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Rothera.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_zh_CN.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libscaletempo_pitch_plugin.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.css_1.7.0.v201011041433.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\mozglue.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRdIF.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Mozilla Firefox\softokn3.dll.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT.tmp da0288aa5455216d53cacc8e1e2ba570_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD58e734cab91f187893fedb2fac6ce904a
SHA1c2a925d6c9eadb09b74dece2476bff51e6368d3a
SHA25634dce47a0a523f44e2f0ff8ea4fce3638c548449f2195d6147b15c812a30d60e
SHA512c7401a4f286729aee4e1cf98f6b79e1af616ddf6945b54bdfae8e4702dfcff9286600b860d03253e0c18c2c68396d6c855a0c4eef8dddf5482de7331299feff2
-
Filesize
68KB
MD539a47a25cad0f1d312f255500f858017
SHA1712127d86e716d84e3f4ae23ce363e4d05ac6b2a
SHA25601a396706d98de06c4f4da15a35677171eea8f8c7b947824e1887c8b9dcfd8f1
SHA51246c45a207c4f99ad9c42fdea34959181cf950f512579bd1fc1d8c8bc151cc70af4bafc4ff3dd2ce11eda2c0f109cf7b2d92724d6e5e6de6fe7cf742654c22e87