Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 04:55
Behavioral task
behavioral1
Sample
4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe
-
Size
69KB
-
MD5
4cbeef6ee6f45e5b1404f6dfd19c4b80
-
SHA1
774bca1000781a5ce9262d168f4bad89ed9aac81
-
SHA256
f4bd9a50728d072ce3bd3687059dd43da1227923646c85804deed5c45ae0b20e
-
SHA512
db26fa9045d984b61d91a988333a4c69e80d48e3f7c3158073b45f187a4b48edda65671edd21c4dd87a46638e4791845a8379f493aed7309ab3ad0c665c25d04
-
SSDEEP
1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8Oyg:fnyiQSonyg
Malware Config
Signatures
-
Renames multiple (3685) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/memory/1212-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000500000000b309-2.dat upx behavioral1/files/0x0003000000010440-6.dat upx behavioral1/memory/1212-654-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\dcpr.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\gadget.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\settings.js.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\26.png.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\currency.data.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\sunmscapi.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Thule.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows NT\Accessories\ja-JP\wordpad.exe.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Monaco.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Toronto.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\de-DE\wmpnssci.dll.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\it-IT\wmplayer.exe.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Yerevan.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\ReachFramework.resources.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Photo Viewer\fr-FR\PhotoViewer.dll.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Purble Place\es-ES\PurblePlace.exe.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office14\MSOHEVI.DLL.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\ktab.exe.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Windows Sidebar\de-DE\sbdrop.dll.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui_5.5.0.165303.jar.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding_1.4.2.v20140729-1044.jar.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe File created C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp 4cbeef6ee6f45e5b1404f6dfd19c4b80_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD58a3ce4b8c35dd33860afd59013269132
SHA1d70e6838fb5853684624e461ee274b7f516869aa
SHA256e182bd73ac5ea5f6ba45115ab7f6ead8e4f399b862ee41190de000c7e0d90dd0
SHA51283f7bb143b3b4f5bc1239d0c01a8af8e54aebd715cef0059862bfe5c282b912bfab8f59b5fcb9426ab06e1bab22f68e01f5abd8906c0d0073aa136e56fd0311e
-
Filesize
78KB
MD55982da83980060da0412311af190688e
SHA1f810ce3765d33b74fc635ade6172e48a429373b4
SHA2563bc19acff681c4468b491025f57c592ee824dba7bfd40f5f6812211c391bc999
SHA51284eb058bac0ff51fd9bcb4ede2c1e598919e581131ec74341b8b5bce1017546a2e47d475da4c7df78aa06d1df3b8d3ab824cf7f083f0b24bacf81e4f81eb776f