8082aae83e7f75c17faa10758920f9630e9d654ec2fbb7a41b53a2ed597980ba

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
Size

141KB
MD5

d6788ec7914b17e6dbca2ae73c4433d0
SHA1

099677f3c1e21410c2bd799964de05b555905fbc
SHA256

8082aae83e7f75c17faa10758920f9630e9d654ec2fbb7a41b53a2ed597980ba
SHA512

a2945a52da4e891f9589d50956dd81d1527bae7382d568ba4b04fa4a7c2d7d1950637ba902ba3e1c1ed481650d4fc733e0b88d0b7d3545762b8af91a43a51fc3
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c5cfYfy:/7ZQpApUsKiX26C

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5017) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationCore.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-pl.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Input.Manipulations.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\CHICAGO.XSL.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ul-oob.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ul-oob.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.DLL.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\110.0.5481.104.manifest.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero2.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jvisualvm.txt.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationTypes.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCombinedFloatieModel.bin.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\vcruntime140.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\ReachFramework.resources.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp	d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d6788ec7914b17e6dbca2ae73c4433d0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
141KB

MD5
bef3cfec96ba0808bd9c367be780728f

SHA1
4e2d7b75e1907f3850dc78a2878bcf5022acb131

SHA256
fe56d61f65e23e45725d6488a5fa0eb7e72f53b12ba45cb18c54be37b66d9e26

SHA512
a8506b3fc27a7837dc17b839309a13da9f527334cd0a3338293379741eed4364debbab88861f6963b86f87fb18a22bd201f48dc48ba46ab10b262f83268e0e02

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
240KB

MD5
8fb593ee3731de5da37349d7310bb78a

SHA1
7d9cdea8a4b1706b7bb82cddf0b7abea48ffc4bd

SHA256
06a8243d913eef20cf1fca95a8297ec2022adf5938a2024f9ebfa1739d49926e

SHA512
364cfdb10b90ae4a8c766774cd9ca09df850e07ae7b7f242ba3bc30203c97522eb2e7d26274b494eaabde5681e8707e646b318a7081e7d574f6702d5394f8fa0

Download Submit
memory/1664-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1664-1800-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads