Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 19:24
Static task
static1
Behavioral task
behavioral1
Sample
d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe
-
Size
126KB
-
MD5
d688c4a527821dffbc140e1f5a9f2ce0
-
SHA1
77ece95dba11e26d5ad80e2d85efde275e338b23
-
SHA256
0c8058b86863aa411f1a6216e1438869ffb83d3d8a4b22d09b58fb6d0466a489
-
SHA512
654d7b795a50e28d191bef7c3b94e85489be4c8c123bff89fa281518d886b2d421abb3ebb1fa720e4324ac8921695d8b86ecd9ee480c807962b8f65839392061
-
SSDEEP
1536:W7ZQpApjIWe+eoO6O2lpiMZiMLJvlwJvl9:6QWpBe+eoO6OaiMZiMLJdwJd9
Malware Config
Signatures
-
Renames multiple (4830) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\cpprestsdk.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.exe.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-pl.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp d688c4a527821dffbc140e1f5a9f2ce0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5af1c7a6b4333342eaca4cc5838cf0ff5
SHA1cff967d11b35ef5a42203331b1806272117c09a0
SHA256e5802534f2504299a192753c1573d4008600cfa19e11f420c8ac318de4eb69ce
SHA5129eb36ed26124a04417070abea312022763696c6aecf30df0197b9fa801d43bb3680f67f81e32c745637e54f6409e8429735933bf8ec902332ef2268157e29cbb
-
Filesize
225KB
MD54c3789f82dc3f931abf78b4eb0543d67
SHA170991d588e232119976d2c431bca0be7ecc9ae4f
SHA25653c24284844f56fc92754a9e260c1adf992687046e7b067b01ab641efe183d6a
SHA5125e9ab8f1d769335f266a6313958969f760057fe03fcf6d0a8a975e36280b47444de863baefb805054fa57e0c0001dc5f4e6bca51ecf95614e85119bef3b436fe