b586527efd9711fc2c1e9f90c048c4bc03a89860ab47bfb277de0de8e092f498

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
Size

71KB
MD5

4ff51f8c302bd2e9b1d9db33c4aaded0
SHA1

15a564c56c53bac83ae0ad24874550927c689eb1
SHA256

b586527efd9711fc2c1e9f90c048c4bc03a89860ab47bfb277de0de8e092f498
SHA512

ec0ea6d0bc1cb221e734828e831a5fc02e07f14b1c9ee0f176d0753000cd5c17a351f1d469936b075e6b57019d328bef7b39149c5e7f43feaf84bb41e731900d
SSDEEP

1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696v:6e7WpXYvndv

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5025) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\hostfxr.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\WindowsBase.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN082.XML.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\VisualElements\SmallLogo.png.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\react-native-win32.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OIMG.DLL.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ul-oob.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.HostIntegration.Connectors.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-pl.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JavaAccessBridge-64.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Input.Manipulations.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\4ff51f8c302bd2e9b1d9db33c4aaded0_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:4868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
71KB

MD5
a835f861a23c3821643aafc5dcaa73ad

SHA1
55fd9a498d8bca30e8f4c957407c3bd490dbd908

SHA256
8d16638017ad030b20765dc14b8f03d9e5ad1fe06d178cfea865c15bdc6c7921

SHA512
96449066beef67f073f48ad109b44ae8d8e9a355bb1f6e385c4823b182ce164c3c764d5e34dee78ffdecf26c264ed7a7463bbf050231d3e74c31a734bd7de721

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
170KB

MD5
4c8076cd10c93357eda7790a93c6520e

SHA1
654b8a6fcd5aba607fb0abecc10021a55f3e7493

SHA256
05be637e6e44438c5c14d88ad5be07f6f6f866953667f38ca1334ed46b937dd9

SHA512
48c97cb1ef53276c6a0713649e5669d2be326adc6047bad0e48361dce5d80636b00d3a6bb5a3cb3a47579a115bb6ecc12e43418c8fc2a7c7d99ed00afb517378

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads