Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 06:59

General

  • Target

    b71a0b998562e8e6503065c079ff3a80_NeikiAnalytics.exe

  • Size

    78KB

  • MD5

    b71a0b998562e8e6503065c079ff3a80

  • SHA1

    e600b1a451f552c0b507e8a747b1fe359b999f91

  • SHA256

    af73c5edf6e2147fc99ca70a0d6d076d96ecbee1a62d9a9f7e9c45c06680c4fa

  • SHA512

    1308a2d1c4ed735b7d8b3a9d5571ef788a3b4821f059bdce5e2c7904e69f55caa53c677b174e9a590aa5982d4cf3dca097c9ef592b2b0383aa0f9d280f255afb

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7YWtMQQQW:6e7WpMaxeb0CYJ97lEYNR7Ztq

Score
9/10

Malware Config

Signatures

  • Renames multiple (3727) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b71a0b998562e8e6503065c079ff3a80_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\b71a0b998562e8e6503065c079ff3a80_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp

    Filesize

    78KB

    MD5

    d34e35179dab18e0e5ef1faa9ebd45eb

    SHA1

    2f8815b19305514ea75d23f3b4440855723e6246

    SHA256

    b457d9d4591a816d919b1eacf224e0babfe9ffadbcb628a824cd702527fa9f2f

    SHA512

    0c3dc514099a6181c2c7f266aea4af56fcfaf114f2ea437d80340212066f64bf51c73566c315887ef45d486a7240e4bd4216777078ba84240e19387926a8a3ab

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    87KB

    MD5

    b088cf0924b2e7b6d48b636592fabd62

    SHA1

    6246d5b69c88995e95586f3846940d1dd1149fb9

    SHA256

    49a6fcb7dbee76d4c8e8c97afdfc2b2b9b462f3a4be0e86648fc4d886ff3851a

    SHA512

    49b93d48588b12bfee9c3a9edb0005831c3a2e5300b962d1298cae7891e6256597862b24045db952bb8610500a8dcfc4b061263ceb75b9240dcfa46a27e1c862