134088912ce544c6994b9823a40a3fe4da2aa42603820bed2e1dc5e59fd8c139

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
Size

57KB
MD5

e13e6882960b9c9b3141b56d8c882740
SHA1

90c87929ee52c22e0ba2e779d8216684069ea15b
SHA256

134088912ce544c6994b9823a40a3fe4da2aa42603820bed2e1dc5e59fd8c139
SHA512

100ae72aacd104c16813ba1b0c6c241a6651288f65b0ff41b03f5b4055b612026e37937ba02f1adac4d44ef8428d477ab25748a1bb2eda0ff48eb4a8cd89851f
SSDEEP

768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2F3FF:W7ZDpApYbWjCDOQ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5090) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\directshow.md.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-ppd.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\it.pak.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.EventSource.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.Linq.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f2\FA000000002.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Drawing.Primitives.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	e13e6882960b9c9b3141b56d8c882740_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\e13e6882960b9c9b3141b56d8c882740_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\e13e6882960b9c9b3141b56d8c882740_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
57KB

MD5
a5f7552412e411c49237f74c03b3b2b8

SHA1
293607a91502bd09e3e87fb59bd5de41def3fc63

SHA256
dda61d952f8773b9c006038efa1d91836caed2dd9398ffb2bc8acb64be5d24db

SHA512
d11f001d81c34fb4a19448cbff3113c19ff443ddd3629c7af8d153ea31a2ccb9e1889fa40e7eecc26a4dda3d747211e805943499073228c91589c2aa93ff68ee

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
156KB

MD5
174b14e57b6ada6ad97098e6e4a752fa

SHA1
83c143acf50868f89510d2f02129f63eb33d788e

SHA256
6399a2a65961140516b322d4a9d1dda8015ae81ce49c54de9bde7ee952cf1d9f

SHA512
558c4ebecc17a09e92de7b90e268b8c9a2952809dc2553ba4f40a2c6e911ca0cdf0bc4aad03fc6e03466aead7ec1abe842168eea415c4bf7a856eefb99137a55

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads