9bb1b7aa918b0bc989a78c0a94e498bb41a1e7351e0ad92e7d8f16080276fb27

Analysis

max time kernel
150s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
Size

95KB
MD5

a3f801226c14b8be5ed6ed4dfd8e9b30
SHA1

6f1a04e07533b6b52cc3071bf48715fef1bd7577
SHA256

9bb1b7aa918b0bc989a78c0a94e498bb41a1e7351e0ad92e7d8f16080276fb27
SHA512

65b516a450ac2d290efe2a7a76b68936b94d3cbf3ef31ec94d9844c33af1227ebe1a2286b470c3c0f56ad3fca311eb96925ad813701c8a4dd2411f771af89f87
SSDEEP

1536:W7ZhA7pApH1IwVHykEElEa0NQn0NQie+eeaA:6e7WpnhkElEa0NQn0NQie+eeaA

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4831) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ar.pak.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_es.properties.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\lij.txt.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\7-Zip\7z.exe.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.XML.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClient.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ul-oob.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-100.png.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\cs.pak.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ppd.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\a3f801226c14b8be5ed6ed4dfd8e9b30_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
95KB

MD5
439cfb0326c68afd0cdfcc59e64ba906

SHA1
dc95fbf9fbb4dc2a87c4d1dde8d04fc2effc6343

SHA256
c8bf2634b338b2bce49027ba33b4584955ad81fc4dd75fe0276f66b42eefa00d

SHA512
14783c071d4328166dd2c28ed46c45cb7f485984d64b7f45474dd2ebc55bb2a19e1ada6abfe2aa6c3850e18e6bd7dde6d179ec19357ce9b2bd6c69f459c5787f

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
9f789e0ec300324b676f72bc9f7b95e6

SHA1
188d41b220eb92c013de2fbaff3ac73b1e12c0df

SHA256
237c3b1a2054ab99a5318ac285831c73b81b84164e5fdce4493b747d46494850

SHA512
205453101a7abdab91529601f4ffa7cda6144947fd21e55da7d4f9734bd8967f5e2e8a946d670773b917fe7d7c6a20221ef2fd348444ee8bf396b2ae99e7bd19

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads