29284d72a6573de6ed897391244d42c4b07a569dda1fdb25d0ff8a80f85adf35

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
Size

66KB
MD5

1eeb01d068a4ac43a20329ac708d3750
SHA1

6a927cd9980d7715626a9843c35541ba91ad6be4
SHA256

29284d72a6573de6ed897391244d42c4b07a569dda1fdb25d0ff8a80f85adf35
SHA512

61d7100c4f815cc8fd4b3577f942cc7e3d9c8f2c83d641b7de843d7b176e7dfb54264450d2e826eaf513207ede958f2135052d9ecc7dc59e7bca0cb469da900e
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReP:W7ZDpApYbWj2WTWJe+e/q6

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5072) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Cng.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ppd.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-pl.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\vi.pak.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicudt58_64.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javafx_iio.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.SecureString.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN103.XML.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-180.png.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1eeb01d068a4ac43a20329ac708d3750_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

Filesize
67KB

MD5
d0d4970901ffd57655cd783ed0d3238c

SHA1
4c7f36d7f1672fb159911305ed0860af4dd42a5b

SHA256
8bccfc17564a4c73e49dcb87912d6b51a69c7bd39aeb6eae4d56f7933a540973

SHA512
7c8434e8c8ef008612a0c091e9769a7c8a74be70b71baf505c287652ab28217f03a1c575a3114a4c8c8af25958b81e25145631ab9438495154e5daffeae43a2c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
165KB

MD5
2a8260e553e57c37414a12c7fb638160

SHA1
af10313b4d23d0ae2f8fdbb061f8828a47c97738

SHA256
67a20f244f0c42ec3352e7b43546b4d0e8a4fe7cc6108ba9063b2c3b406f08a2

SHA512
f2af5fe4ff1935fb93b8f42142e9bfda27033f069170ae867652f814b947dc6e90fa65730797abccbb0650a03a19051d2b943e2b6c57e5cfe107ce84326e69ac

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads