a9f23e85a98acd4f0f10ed97db73b304877f5ec3cb208af569198f9b4da908c2

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
Size

117KB
MD5

b7bfd142c0237b561e96b96a2ab3cf80
SHA1

cf14fa82ff4753f1da172c70cf95ae68929c260f
SHA256

a9f23e85a98acd4f0f10ed97db73b304877f5ec3cb208af569198f9b4da908c2
SHA512

70b402c25b391aa0b0b8a919ca2aed2127fa037700ff35676d95a8aafa04ce4bdd5ba915b12ef4b10076b62a902424089d0297aad5f2d6f6b27253afc00365cb
SSDEEP

3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzh:RqlIyFESWu0SWuGS9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4845) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFUI.DLL.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsBase.resources.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-pl.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\sspi_bridge.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationUI.resources.dll.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\README.txt.tmp	b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b7bfd142c0237b561e96b96a2ab3cf80_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4436,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
1⤵
PID:4660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
118KB

MD5
a6f35a57bd0699de7a02004c2ed21b9f

SHA1
31f522ffdc0ee7007ed2020c8b48afaffb1cbc3c

SHA256
416885b65f9301194cb761408040af6800b1bf5d536b64225ef2c991b2bff5ef

SHA512
b1d4ae94155d59cb8e26076434f3495e93bf30efa5f4a55349ecadec5cd0b39e8bcbb25bc6a4364a7400d027dfb8e39fba363694d93a0657db0e08e18ae5490e

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
230KB

MD5
280f15d1e822d43a79ee0cea4a8ec631

SHA1
62b2aff3927f14b67152b8fb34e40d18e193283d

SHA256
5870cae5206697ef5d762e7f4ad90055d6ba2d81852780a53cac69a13dd2b289

SHA512
af86c4abcf7f3ac764a34e06ee9daa83051c188b0657cb29df3511cb03458cf779b95fcb00031e64466a0c0e08ab545fc6be94ddd36203610643390a3c1d494b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads