f202da975fe4ecd4ae376b92bf80fe40489669b307b126feb04335852500a8c3

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 21:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

34988435196d45705014e50db64ef070_NeikiAnalytics.exe
Size

128KB
MD5

34988435196d45705014e50db64ef070
SHA1

23db71a6fd245fb60451cda4c12149ac9f13c631
SHA256

f202da975fe4ecd4ae376b92bf80fe40489669b307b126feb04335852500a8c3
SHA512

8beb7db57bef7e148cf17e2a00da396c142cedcf6b48348e28ce294a1ad97e80e52e4423d82203b25874a833632987e9afbf1fda4e8ec16197297670eea8896a
SSDEEP

768:/7BlpQpARFbh2UM/zX1vqX1v+1WbW1rjrA9ZONZOD5ZTXB85c50KPKR:/7ZQpApUsKiX26KaU

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4841) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.Common.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msix.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\SUCTION.WAV.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ta.pak.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.Primitives.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-pl.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_COL.HXC.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-oob.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	34988435196d45705014e50db64ef070_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\34988435196d45705014e50db64ef070_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\34988435196d45705014e50db64ef070_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp

Filesize
128KB

MD5
ff9e9605519ff2b93006851c30db9163

SHA1
fea53d9c3f06eee56b069341b53409e91911a10e

SHA256
3c4c40a594b2f3bf604ae0c840cb8b72a364b78c0f0b93dc7aa785967a3886d7

SHA512
10657495d7d3b2f5edf6c9f7a3d8334a304a3b786125fc550a390181c962cc178cf80ebd91962f3f345495590bd653c301de0ee0f5717b6c1554190f1dcc5b69

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
227KB

MD5
ee4ba8132c56a1d9839164747a048744

SHA1
e2b909c8c859ab6b2e74101661c8bc3df5cae08c

SHA256
4b4253670ab344191577acf96d21f6cda1bdf30076a7e0c6df6c00cdfd6cd092

SHA512
37ce6804ca00e41d7e3f780e1e07b3f92f12c11a8857940b04e3b5458462aec46ea53f082ae99cbab50ddb438f340982732402fef46abbc3b34ee624d36d055a

Download Submit
memory/4700-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads