aeca93b90ea7c96988f2c30ced463403d89db84adb5791e676c00b3aa8ac0b9c

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
Size

84KB
MD5

11f89c81e4ae2e16a6b890e8034e8ec0
SHA1

e5f051bad714cf5a29e0f33cc9c3f6872e2d4537
SHA256

aeca93b90ea7c96988f2c30ced463403d89db84adb5791e676c00b3aa8ac0b9c
SHA512

26676eee47bc1f22edc06ebabd77d4c9da1dcaf9e49b263df01a38396d5aa81c749e6a1aa620341dc180794405f15db72032649f721f33bc7de185d30efcda5c
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPqz:6rWpcOPxPke+e3fFpsJOfFpsJbgEY

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5076) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunec.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationFramework.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClientSideProviders.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Formatters.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-ul-phn.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Xaml.resources.dll.tmp	11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\11f89c81e4ae2e16a6b890e8034e8ec0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp

Filesize
85KB

MD5
659b9053b9d30d95ac091a3f2e5cb229

SHA1
c3c616f640cc14f487b722396702803e5a665794

SHA256
970dcc92da4cd97040faab94695278ee6dbcd827b5beff3d2809107b7afa1bbc

SHA512
99d706c4588d39e20a0c48ffc55df7d687cab44bed01e43432f9621bbb8ae01b2699eecd0f667472cc1bdc51b84a3107a6063a8287348fcff40167720c990f9c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
183KB

MD5
ef7acdd5ff90beac97f30b39d6ab85f9

SHA1
a45fac644bf0154d695fc2867273fdcdf6878072

SHA256
37cb23fe1b043bcca35e2efd8dd561c98c95b287178a6a8ff851b575063696e2

SHA512
afc09b43a019673de097f5f0a1b3895830ca1a9861f7456c40d40a32db5fc5babf0af4851aed07eb3de8ee6bbd34340c46c8eeabecdf362a3a6ea8156a592bea

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads