a3762abc9439e14aae48be00d28c3435fa2afea4a039f525e474f920e4c1ae1e

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
Size

68KB
MD5

7c7b1a40ca6b08b1b105d443bc476ad0
SHA1

396c8eb7b92b8dd0cfd523a1df5e840d9a191cc9
SHA256

a3762abc9439e14aae48be00d28c3435fa2afea4a039f525e474f920e4c1ae1e
SHA512

d4606544c63b3e7aa376206e4043cef19b621d1be191d049a8abdef9a59b9d7abbcaa443fa4ce71cf00c3e6d5d58723b1d357eea8d615212ea6f69556c64d28c
SSDEEP

768:W7Blp9pARFbhQSox/6Sox/ME4JAIAepE4JAIAeuDlmlQPc3f6Pc3f5TGotuMOiJT:W7Z9pApQESOHepOHe8G+6E65TGAD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\System.Windows.Forms.Primitives.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Registry.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Forms.Design.Editors.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\UIAutomationProvider.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\WindowsBase.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Numerics.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Claims.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\PresentationCore.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Process.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\PresentationFramework.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mraut.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Calendars.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Requests.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationFramework.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Contracts.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.ServicePoint.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Input.Manipulations.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationUI.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Forms.Primitives.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Numerics.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Buffers.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationClient.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.resources.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7c7b1a40ca6b08b1b105d443bc476ad0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3736 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:5028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
68KB

MD5
a35aa3cab9490647699775a3e98246d3

SHA1
89e30b3d1233aed02b30b6511c0465fe5782f5ad

SHA256
00ecd49635e31ec2c1152511284b8c53cafd2778f5faca7f0ad64d419de74cf9

SHA512
283510544b51d780bf2d85351ee1756411b25b51aff4e0b8230cacebf255693f678a7599544fb5cd92c01191abe0cd6a1078aa4773f5507a25b81cf8d2ec0aa4

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
68KB

MD5
69bab6271fa98041d0a644a3baef2ccc

SHA1
bf2ba13eecb535b3c03ca78156833cc10af65eee

SHA256
979df7bc4278333a705b7906efc730c96c14da14ca575eb90fe81f431ff548de

SHA512
9314da76a216bb0dc245b2effc796b7bffdeb98f9f087c600fe333b5bfc73590dc8d99be921b24fa879e6befc08aa9ab6a0e90fb693cf9ac72734b89dc24227b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads