cd71dec8e67b25472829c5e511c16ec202e95cb7cf679c9fab264399ad0eaf99

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
Size

69KB
MD5

221dd154b1fb0e74f45652a44a9ff5e0
SHA1

a726dcd3da7fb3ede437ba4a42c46f6e7f6afbc8
SHA256

cd71dec8e67b25472829c5e511c16ec202e95cb7cf679c9fab264399ad0eaf99
SHA512

9df2216851abf232f2cc258a1ce336602b40b64d69ebbc17b3edc1cf44318f8bd3942b1f4b1de7856f8bce1f836822bcf0cb4f237719484e6adef24e9f5edb93
SSDEEP

768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJ5:W7Z9pApQESOHepOHe8G+6E65TGAJ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4871) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\lcms.md.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsFormsIntegration.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymsb.ttf.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jdwp.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-phn.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.CLIENT.CORE.DLL.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\gl\msipc.dll.mui.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Primitives.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationProvider.resources.dll.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL044.XML.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms.tmp	221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\221dd154b1fb0e74f45652a44a9ff5e0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3740,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
1⤵
PID:4720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
69KB

MD5
53680a428470aba88e5f9be30e155da4

SHA1
b5f497599a0744df55e3b5ca1582c1d3be669699

SHA256
ecabbe03b9245521c7afbf3bf2d8274b69a6980f5522cc2bee5798d9332579a5

SHA512
cf0ba91504eaec161d9dd379fe4e6a61c5aa2412d7e2ac7ab4fea7b695b00762b8b4eccd856241b5864d17d1f550d42b8b2d9a56f8d14d4a7259ab99ac613645

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
181KB

MD5
bb88610df4d7c5a3a367b398ff15e3d2

SHA1
57019e765b1d58ca5f5326be3e6dfeb4181fbc18

SHA256
de9d9dd7ba9657910439d545881215024e5792f6b3a9f7ee12d44d79c5896591

SHA512
08ad1b8899698cb9d2aaaff310270668318b11316dcdebaec810221c585aefd95793f58f3650d288eb3f18950f610506b5ebacd30200dff64dbdb889167454ba

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads