Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2024, 19:43

General

  • Target

    30bab38ca28f5ace1a9da25c33caba40_NeikiAnalytics.exe

  • Size

    72KB

  • MD5

    30bab38ca28f5ace1a9da25c33caba40

  • SHA1

    1a58588b6e7076a098a6b6e120c04d1cc722bc2e

  • SHA256

    9db3293defce2f326d4a9757eb26e2c0f71b27a6aa2b8940fe77cf1806a848e9

  • SHA512

    09190e9f5c0c1f8bf343a6fd7cc26893602843a000bc7e1be87d2faf1dde792841a7740097b633ed2f8cfe79185f1aacf3bead179be26056d7073aa40be84c90

  • SSDEEP

    768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2FjJk9O7X7vX9O7X7vR:W7ZDpApYbWjCDOcJO

Score
9/10

Malware Config

Signatures

  • Renames multiple (3751) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30bab38ca28f5ace1a9da25c33caba40_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\30bab38ca28f5ace1a9da25c33caba40_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp

    Filesize

    72KB

    MD5

    bb669810d007d2baf4329c2385e35bad

    SHA1

    042985627209e4fcb55098ef4037def90b276eb6

    SHA256

    51800e0dccd44fd9c724149323f9aca2eabb61e1c51ac5e6ac776ee81fa3e26e

    SHA512

    6aa60f705dd35d2cf2ea37289d89ac31ddeaf70d349eba55def3b2e3491721260f44102966241a31a334b57602f84bf6e1d9ad789bf61d8cd4788146003a780b

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    81KB

    MD5

    e84ad56c7fc105728891b49a1682b3ad

    SHA1

    0a7552cbade8941fcb7d08a3b0edd008a18bb91a

    SHA256

    ce7e0dbf981b3a35c69cb99487f3587134acdb57bd0027e1d1d3a73f36a4ed4e

    SHA512

    84c8c5958cb0059b8a264112a7c645554a950ce3879ac8f460934e494934b452ee15733502d3e35a025f278ea00997e2212a2e55b09ffd627a9fcd073da6a214