8d3f610407c9f59e19283748bf129ffc0d41ea8bbce4341682f267c334f866e1

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
Size

71KB
MD5

2d5cd13a1fc63739d3dc96005a7d2440
SHA1

9859c274ffc5d1182222b700cba8148834b1806a
SHA256

8d3f610407c9f59e19283748bf129ffc0d41ea8bbce4341682f267c334f866e1
SHA512

45568834f01eca1949adf86519cb1e3b0ba62f522abfbd66410990109be32f2d3c0fdb27fc36593321ddf53ba063acfaba719334c53b313f2e239307d9f6c4eb
SSDEEP

768:W7BlphA7pARFbhVSpFCpFi/1KxAzMlcH3GEHUAn3EM2utGHtGiZh:W7ZhA7pApVyCi/1iAzFH37HJ0XuYvZh

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ppd.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-phn.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-1-0.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2XML.XSL.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.IsolatedStorage.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-MX\tipresx.dll.mui.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms.tmp	2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe

C:\Users\Admin\AppData\Local\Temp\2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\2d5cd13a1fc63739d3dc96005a7d2440_NEIKI.exe"
1⤵
- Drops file in Program Files directory
PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
72KB

MD5
ad59172abe4502b5cbf2eee43016126e

SHA1
67f225440bf0b17a8b5b5734cf273dbc67d3d51f

SHA256
da29ee452197ca9f1da67797139dfd03c16452ed9a947bd0dd22e3a87a4a5400

SHA512
af4cb3f56c2ebee0ba2c6febd851f8f42faedd41cb007202b754856030373e63c961dff7810cac000316ca69a4c0fbd94d45f0bc2f4349cce5381b8462f29b76

Download Submit
C:\Program Files\7-Zip\7-zip.dll.exe

Filesize
170KB

MD5
7304139aa7e641c3a71ebb3de54ca8be

SHA1
c82ad8ecef8ce03c41426828f88bcaf2ff960a70

SHA256
60eee58805508c66bf4fb5be1505c4873becfee4ecb72a9525e58a32304b484c

SHA512
2167dec6dde052bbc15088fda6ba54a953c215c4c0ebf6c4e1781635059864ff704e3d35f2d8a3acdb4fb9b5cf1511bde35ab01998d61c634a303f605f39d83d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads