419ce29a7f043828020e623111d1e333a019091c5c42f581d500667df188e18f

Analysis

max time kernel
150s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
Size

79KB
MD5

73bb064b2f44f6710950b47ec136b630
SHA1

c9a42a55539f4b29339a4227e412d6e98014fa69
SHA256

419ce29a7f043828020e623111d1e333a019091c5c42f581d500667df188e18f
SHA512

0179a4fe7986d44bff29eb37a1a3f526a44fa92f2af583468eaee71e95a7cda50cfc40ec10142ee9fd5a24541730a1595c599b6d077994d2b8fdef6bc58c6d80
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhh:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4856) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.Watcher.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ppd.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\it-IT\wab32res.dll.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPCORE.DLL.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11wrapper.md.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ul-phn.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.vsto.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationTypes.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ul-oob.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ml.pak.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Specialized.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll.tmp	73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\73bb064b2f44f6710950b47ec136b630_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp

Filesize
80KB

MD5
3ecde833106eb05348c2e552a144fa67

SHA1
7f66c65548ac6e1c9652c5429a33a6409b6de8d5

SHA256
b0d013b1b40c1cdac4357ca2b74ef3be9f9c6968cba8d6cb2e19f8ebcc7cb4a8

SHA512
fe85d655989e4a7a773f25aa35cf343f0960b4c9b6d666a690ea31eba426fc33162626547065818eb141c27df41ffb1a90892bc0b2a598a8ba25fa18cc57beb0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
178KB

MD5
2f43dac6a1e974329c71e8abeece129f

SHA1
7ce33e5ba826065eb0d663aed4267c15966d1b25

SHA256
d4a27ba9f203d4a9e67dcde9968a4366ebe59f221114b8a6806df16dea3f38c1

SHA512
27a625b4a428878c693205cc80121eb5ce0716e32fa824de05b76d6b71714ec53a3e444bd9453ede659d9bafec44c1e003455eb3155b1115c6b0d9fda0b5dd84

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads