Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 05:58
Static task
static1
Behavioral task
behavioral1
Sample
86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
-
Size
93KB
-
MD5
86dc41d03f622705140c7b6a71967fd0
-
SHA1
d22314168952740391b70c934418c2f5323a45c5
-
SHA256
3ee72d2a46b16b007fc31a5586d50d50f65451482461fdcf9f995e717633c27d
-
SHA512
a4e9be4a7bdd3a4aaf6227866cd586a7c9a9f2a55422e5e6a1686481bfae2c2683843c742ebf8af9ae5aa1a8c8a2a6459b768f89dbfd926c633d0d34655b0692
-
SSDEEP
1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKP76PDn+I+9:6rWpcOPxPke+e3fFpsJOfFpsJbgEODm
Malware Config
Signatures
-
Renames multiple (927) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-fibers-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-handle-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.DispatchProxy.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Forms.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClient.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processenvironment-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\netstandard.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ro.txt.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\ReachFramework.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsFormsIntegration.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdaosp.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XmlSerializer.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Emit.ILGeneration.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationCore.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsFormsIntegration.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Extensions.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Intrinsics.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Serialization.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Xml.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Channels.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Specialized.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\Microsoft.Win32.Registry.AccessControl.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.DiaSymReader.Native.amd64.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.DirectoryServices.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Buffers.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Design.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-environment-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\ReachFramework.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.Design.resources.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Resources.Extensions.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp 86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86dc41d03f622705140c7b6a71967fd0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:2656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5e944d1244fd79cd18f20f87d670e06d7
SHA15f10884bbb973998e74b2934545525d632c90560
SHA2563f8c649926bfdf8552b0132d9ad0d78baf53d60abfc6debf271aa8aba6424b9c
SHA5124218e8651a7f30af4342aada99022f7e9191489e2d2a3bbf05a1046e2806945fdcd64e84fa6e342ed003a47a6d4df8e32f5bd321662cff80ef8d38869145c5c9
-
Filesize
93KB
MD53231f03b57b752581d90b790e08acaee
SHA11f19a96540f069462345f64d36c18adee3fc4856
SHA256ea3081836e5ffc75ea6d8d8bd330a169b9750506eb352714c7ed422592cdeeca
SHA5129e801a53094e20aae865e849ed704945552c5954b8e38c8ed34349887f9a996e4fd7ede00781b940ed6720a0c1a154463aa5e54cb14df224cc5f116277545190