644f98aea11238ff95a1a1bd0d3dffca4345fa00a586d112dd36b0a78404d57c

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
Size

80KB
MD5

7e4aff1c2e53b193ca76559f66e41940
SHA1

98ee9565c4e7eab17c49b8709f598a9e61f19853
SHA256

644f98aea11238ff95a1a1bd0d3dffca4345fa00a586d112dd36b0a78404d57c
SHA512

6cd7e8fe694d24032d29f2f959dec732df4b004bfede092ad2569a55b67a03896f562d8a6f114d9c5c9e6acbe52c9571ee84109e960f1b6446ef84373a5e2021
SSDEEP

384:GBt7Br5xjL8AgA71FbhvUf2OkxN2Okxj/zFd1vqFd1vlbLbK:W7BlpQpARFbh2UM/zX1vqX1vw

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (604) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tools.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Debug.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\ucrtbase.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\hostpolicy.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Linq.Expressions.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-console-l1-2-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\WindowsBase.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.TypeConverter.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.IsolatedStorage.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.Brotli.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.DataContractSerialization.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Threading.Overlapped.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.DataAnnotations.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.Core.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\clretwrc.dll.tmp	7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\7e4aff1c2e53b193ca76559f66e41940_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
1⤵
PID:4032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
81KB

MD5
984de03551fbb24018981bc0c67f3984

SHA1
1335bc75bfba766a93b7a9d2b38b094d37e262e5

SHA256
cf10eda31e35a7233c394dfeee75f917272827b3b0dbfe50eead5011201eb20f

SHA512
6da0577e074965ffc2806d085498e8fc8bf228159f359beb19713da9f91e89a50ca67803f2e4feac385331fde3caf3ae3572400a75f4de67eefde24f87e00862

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
80KB

MD5
e8926195aebb27cd715e417fca4a0768

SHA1
b1b62edfe7f5718ebb88727905e87b56bfbd8ef5

SHA256
4c5424a6611aaf81417faf9550ea7b4a74ddfd30c0b3217594dc18133ba949e9

SHA512
298c76de6d21a7a8d8657b756e9f4591b6826f5c6a4daa4a3efb1ffde7265c35914acf8def96e09b248c2fbaca3b62e82baffbfcb7cb93c5c31ad23f8e775b7e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads