41f709f5b928ba04a97255a7cb7761a31df736dcd31dbcc3b36d53e69a4b686f

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
Size

101KB
MD5

e2a12a967f01c369afc036f7a2c99140
SHA1

bfc4df61f15b85bbf2988f7465d33a01b8967d0f
SHA256

41f709f5b928ba04a97255a7cb7761a31df736dcd31dbcc3b36d53e69a4b686f
SHA512

6b16f74459db102f9aa45869dc6ca14428bbde71cffe8158211dfbd7105644e6e98461a2cdbf3a1a197235931521454dff1b67b29261b7400e354888d6a6373e
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN5BsyI:6rWpcOPxPke+e3fFpsJOfFpsJbgES

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4946) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYM.TTF.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.X509Certificates.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoCanary.png.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XDocument.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsBase.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\hprof.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.Xml.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\TrebuchetMs.xml.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png.tmp	e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e2a12a967f01c369afc036f7a2c99140_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

Filesize
102KB

MD5
4547e46f0d4df6d8c430a527a219cd98

SHA1
fbd11c4e88373f3fda2908aa2c93c856c2ca2526

SHA256
c3c216d9d7426b8435573a2433a52b1ea312f7b5e5a641331645ff9869d21e5f

SHA512
9ce714cd99269c9a19340c0c5b9d94b9992c4720520acf44510c38a82caaafedd069e9ec33648151511be5af39170c200f3f624ac1f2795302af81e5bae087c5

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
200KB

MD5
1fd1d8aca05fd08fa10c3427970561cf

SHA1
34c124c908b2fdd4c6a0f01dac8d360ed013224b

SHA256
666f3a0eec625512d817b9a1c57d6a47066e8170bbbc5316818cbf7f9b7dcd23

SHA512
1c0080ec6e9809f9f824492d96d7df98707d4d654f955b49ae034d001d66d8b2656f6a6a6dde714d50374dc71c684a3f50f58068ed3266ec2194fc01000e1feb

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads