5b456c7c27e9d1efc91343cf6cadcd67bbca1db28f1e0f2255ebd511f7d515f9

Analysis

max time kernel
150s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
Size

68KB
MD5

9a288e321ed889d6581c7a28f4f164d0
SHA1

f6956022828b8e88daa74ce5833a0bd58725dbc9
SHA256

5b456c7c27e9d1efc91343cf6cadcd67bbca1db28f1e0f2255ebd511f7d515f9
SHA512

678f943fabd9a65b113397e72a8f4ddd8f9cd3637c1251dfdd3f1055d983826cf48c7cd6262c992dae2645fc126b206be141c938a1b808efda457bc732882100
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyukfvw5R5l:W7ZDpApYbWjIlE77ulTL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ul-oob.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-convert-l1-1-0.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\management.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Registry.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SETLANG.16.1033.hxn.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-pl.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Algorithms.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMML2MML.XSL.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Design.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.Win32.Primitives.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9a288e321ed889d6581c7a28f4f164d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
68KB

MD5
ace05500dcda86ebf7240d6efaa47e86

SHA1
b0f20648400f6c38dd1563b958398d13b13a34a2

SHA256
beb1cc599a08e2612441902844d73b1ce57fd8dc2848bd9aa4a026cc3046ec85

SHA512
5af42bff90b00a0497105e7e0eda5d8e904f16fbf968f043d280866bb9d8005cb2595bab61617a437845cc6104978a94f65fa4f464cff8992618797c0b52d2a9

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
167KB

MD5
f90bce940a4cf982660e54e7cad2300c

SHA1
4ed527a763aa95924b0e9d52cf325050d4c3581b

SHA256
5929b77f7e5accbc1d1f9f928d0d9d80c7aefb343c33024d2428df9fe072074a

SHA512
c95ac3149913c2f4f8eca1c43d02b1673858493c56b1f497069869931b0732ef452011f9c61f1f6a474ceb26f229934b1da5761cb04d5b1041d6e08cdddf7f7d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads