934d525563b1489ec27d6672b37a11fb1436ea58cf0de588ed6a33752e87e8c1

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
Size

73KB
MD5

ac7969c6634b52b7b26b8acf7391e150
SHA1

b3a8570c2f2f7c2b7a662aab5931196001ac3aed
SHA256

934d525563b1489ec27d6672b37a11fb1436ea58cf0de588ed6a33752e87e8c1
SHA512

7315197bad5680e35e2fa2689cc17daa2eb6b0b523664f8ae3eb0e5e3c07ed54bf4495c495f83a772b5d3a7087791096663c08f85132ec01739a5a18e300135b
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyumxDnKIxDnKfoZon:W7ZDpApYbWjIlE77uADndDn2aC

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5053) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Resources.Extensions.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.map.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Threading.AccessControl.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsBase.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationFramework.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ppd.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.security.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-phn.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART10.BDR.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationFramework.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp	ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ac7969c6634b52b7b26b8acf7391e150_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3976,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:8
1⤵
PID:1756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
73KB

MD5
394771b48fc610069de0f19eee03d23c

SHA1
6672bae547aade9e5ddcd133e8a47053529e8809

SHA256
4c351227d7bdeed10e52677d90f8c0e57db89068ea0bad977978798e1a8512ce

SHA512
8a459513cfaf0590b908fd454902927fb7fe0c603ea56163ebb284fb114f5db1d6604a0dacc7369e953f2977677c6d1a640c9e31f883612328134fa05f763383

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
186KB

MD5
7129ebc2e9b9335bf95eca7420a79800

SHA1
ede77f99c0e6dacc57c592478a586eaf1df7c17c

SHA256
c9fec00a69611599a479e90a0df4e017b27f3e8dadc4654ddf8cd198d43e0b71

SHA512
8aa4771dc2c3aa11730b2edd987e00d389870d32cd9c5ee7979bc6b8234148fbd7a9979eba7dfd26bc62fa744d2d88e18684d0ef989861fa131a1c6cc5834d95

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads