ea6c2f81daf549bbf22fbbacd256bd6bc097c1ac09fcdc1f9c0049c7ea2b30c2

Analysis

max time kernel
150s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
Size

79KB
MD5

571606321cc2acc4f11e02a22bf0daa0
SHA1

d0c2c3f23197e075378a150008f0a431a57977ce
SHA256

ea6c2f81daf549bbf22fbbacd256bd6bc097c1ac09fcdc1f9c0049c7ea2b30c2
SHA512

bcdb6167ba8b5e85dcba735873ece511247404dfcb8ac05784efa56f558dfd9f5ec44c84529d313e0d3ae05c1a9c3f78566fba4db9fa167ae02fc65481eac173
SSDEEP

1536:W7ZDpApYbWjnWf05PG0PG26IvxvWyCUyCd8v8n:6DWpDWYPxPTJe4d8v8n

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5095) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationCore.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ppd.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationCore.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationUI.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-180.png.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMSB.TTF.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ppd.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-180.png.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerview.x-none.msi.16.x-none.boot.tree.dat.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\de-DE\iexplore.exe.mui.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Frosted Glass.eftx.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-pl.xrm-ms.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\571606321cc2acc4f11e02a22bf0daa0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

Filesize
80KB

MD5
9dcc9e3abc4b679cf7e18ba69a1bb212

SHA1
63566a6a27b875f27b079ab33efc9fffadd2ccbf

SHA256
fb1f4442dcd5fed134627cc9afee9862739b33a67a03558c291b7cd843226f20

SHA512
d5e70f42bb32b77698d56c23c6e14c0e7745a59ab5d3cbf7699e35265edb8ba2006477cfd3d0fbea7b0164cda93b0970967c0caa03e761943f1112acda2ee7ef

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
178KB

MD5
19a1a26b17a18eca1e228471c424dc30

SHA1
b79cbecdf19c7c11f00d6b9365c33070f392bb63

SHA256
366e2869fc4699855b9a315deb0bd1dc30ff52ee4f076e61f02e89798833ee4d

SHA512
4a8d49de39f9bf1ffcdeda98818ef1a1405d12590bb1dcd5baaa0a819a43e88cfbcdec970cb3809a57edc2437e0733567ff9eaf413d448a83e969a1e62a18c8a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads