1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
Size

91KB
MD5

860b8c5ac6dc360b29de0909b1f88510
SHA1

736d96d3c7f5978f157be7090250c9bb4d323c8a
SHA256

1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee
SHA512

ebb9834d2ed38c3b000d84bae391bf722c064238d5a4d1f25a5795945d59bcf1e0b3ae2f883cfb8d6260c065d0c63fbc7b0a3ad25d9e44695e5efca409b4f139
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJS:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3514) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre7\lib\zi\America\Rankin_Inlet.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Resolute.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.batik.util.gui_1.7.0.v200903091627.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-compat.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Tell_City.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\picturePuzzle.html.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\management.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Asuncion.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Toronto.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\core_visualvm.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jli.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\bin\decora-sse.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\rtscom.dll.mui.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\F12Tools.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\perfcore.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\dnsns.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator.nl_zh_4.4.0.v20140623020002.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libsubsusf_plugin.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Funafuti.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Pago_Pago.tmp	1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1e68e9a35d32c79c98290e01b10cce249f998b680d433c4cf887f6b96affacee_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp

Filesize
91KB

MD5
013200b2f2bc51c8356b2470d798b82a

SHA1
b7641e5b6ab4c56d58b5bab8a05ca50ad5c787d7

SHA256
d29dc4ac0afe0ac124fc2ddcf5fa1ad40033b4326fe34652843b7b697ea608f6

SHA512
1463aa2a41399ec4aa179ce07a3793b2924ae791a277e0113a4c1ad477340fd9fa0355e12a34388a5c37bcbbb7845341c02f3556289cc78f9a14029a135f0034

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
100KB

MD5
de310ef65bce4ceb2784054bd407fe8f

SHA1
02c71993816c80d66e3aa61c2ee381a8cfb35641

SHA256
4d30058708d59ec8d8d824d4ea97d3e697fb074163ea9f1bd40cf19a519aac20

SHA512
23d911aa74ee1ced21c4f1ed10bab76d5473656257bc4814b3b722484341991c635fdbe44b15f42ce202c16b49ff1985f3c241e0f0f3a48a7e5bc1ac9c6bf721

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads