632f259cb6f6f119bb06512526291d59a6d6b722f672df7b7878f59c09d5407f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68869cb6f478b460c94645f2b9609690_NEIKI.exe
Size

84KB
MD5

68869cb6f478b460c94645f2b9609690
SHA1

4f41386420852d3e4cecf2e87aef56251479e637
SHA256

632f259cb6f6f119bb06512526291d59a6d6b722f672df7b7878f59c09d5407f
SHA512

2191997a258f9ed2249cedfb0daaa188be8a5e74adc564a373020a97b0b2fa7dabee4da422f7cadd4388938c30a640403df055c7e5aa2e9c930cf7cc6437fcc3
SSDEEP

1536:W7Z2sspApkZrZnZrZHZrZ1iqktYtlXGkR2SfXGkR2SErk:62ssWpQXGkR2SfXGkR2Sh

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationTypes.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_HK.properties.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-pl.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\de\msipc.dll.mui.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\dnsns.jar.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	68869cb6f478b460c94645f2b9609690_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\68869cb6f478b460c94645f2b9609690_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\68869cb6f478b460c94645f2b9609690_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:1404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
85KB

MD5
a7b40f675b749c718ebd70fb35a1849c

SHA1
4fb18847a5d30d2ee844dd12c07b4716a173664a

SHA256
94270f66a3063ceb98a95745d9aabcef5cc27ac3deb51e8bbfe2c342b50bc00c

SHA512
1128f3d8e6436ba65eddabb336d4077c02962c6e202fed025807ce3ac85e9f454d64561f2a72965c001866c85e23c17b24dd1e7a0434adeeee094ffe288a285d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
58cb848838a73004c3b6ceb407f48122

SHA1
cff50fd6dabfcdc1d43d84d92f7d63413b77d249

SHA256
80aff615321e133ee1cba7b0c39525f8c39bfb5a357c5456505fa40b819e0f6e

SHA512
2fc16a32eceae47933980251849e5f18e714bbb91b25ce50901101f24f828d9315511a1aface2ac97a7f41a8062e7c0a8e6f4382253aae4de6ccf4b843bec3db

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads