47f3febeb1fd7f914873e08e8778692135208d58f22d39184a7ea28be4dc8ba7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
Size

128KB
MD5

02ef1851af0c1988ce9bc64c2484f820
SHA1

eee61dba9aa1a8186ae6c5fe685813dcf949438b
SHA256

47f3febeb1fd7f914873e08e8778692135208d58f22d39184a7ea28be4dc8ba7
SHA512

17e65b24e24ba6afbc9a311ec33520196f185d97648871f6c11eb7855e1505f05d534c68b3c5f40e14f78bd2504b4d467202efd43f13f5476ea738a4514ab0dd
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXBvjfMfvjfMMfQsblBOK:/7ZQpApUsKiXBvzwvzXJvlwJvlA

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4870) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ppd.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ReachFramework.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-pl.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql2000.xsl.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-100.png.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ppd.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp	02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\02ef1851af0c1988ce9bc64c2484f820_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
129KB

MD5
9cf4327e4b6d4aeb1c7d02f5bee95ffd

SHA1
082a33e9f692ae39ae61aea52add6f641593e118

SHA256
e26ff18396c969c02667cf4f970757ad1b71b24082551dd56e504f7ac4e436cf

SHA512
4c9836d3de7fc141eb57ab78c3e64ee0c49e6bdd6e4bf879e9eae8295e8cee4ef57a569ce344c4dbf89f1384315bb6282463632e3e983193d457a02b428220af

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
227KB

MD5
e9d6f7e43d6fc120ac477ef22274c7c9

SHA1
a7034e6c7c6c4fae539601f0423c330c3206034c

SHA256
ece60d5b7af4f732321c74aa2c91d96ac7a1397a30d405d7068c88a587e4da6f

SHA512
500449a81be878ec2bb00b2beedee04e4b1efa0e71254d52f7029dc2f6afaef212965efc6bdc7b905b6158c3e85ab9cd8d1b6ce23cac42ecabe01711e5b1a686

Download Submit
memory/2796-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2796-1784-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads