Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 08:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe
- Size 119KB
- Sample240517-knvs9aad25
- SHA256 996c84026ec238190737482749ad1d89f20cb52c0db39e6d5e5892f26d635750
- MD5 e0e53cabb619a8fe80a778399c8e7830
- SHA1 d2c359a402f845425e00db18e76eca0f7084666f
- SHA512 e79b24138e976e0b59c818c1ff09bbd2f85a991d8cb2e6393f809f809d747bca0aa283aa95580d5211b03d69465b7e5ba333e346b046254fa79c0d2165857b7a
- SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzv:RqlIyFESWu0SWuGSwxk
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\af.txt.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationFramework.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\msvcr120.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsBase.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\AUTHOR.XSL.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-140.png.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp e0e53cabb619a8fe80a778399c8e7830_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 120KB
- SHA256 881fc0cdbfaaf413eb3d603672f109efb9205f828919a3943aaec9a98de275ef
- MD5 f2a42adc1805db3740851b9036b5b0db
- SHA1 d71d48270ae501c9f5a5620e0f5d328be46c2de0
- SHA512 e62c68e6c729be809139f0212e7e03f183b6e946a7e862f1c7cbf3b50785a300a19d242d5814245fc1933bc9489fd55039b19e60a79b0648f2c238d71737a86f
- SSDEEP 3072:6e7WpHIyRF9ESWu0SWuDmhSauvEKxVTLJtxoVz8FUDrYYaCusjdEKxVTLJtxoVzj:RqlIyFESWu0SWuGSwx4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 218KB
- SHA256 d7abab213937322fa093046f9baaf74adff36c5edb521b0edfa47a794b81ee31
- MD5 3a0eb467168ba1ac92b8be71d5ec4bf2
- SHA1 9ba2ff2f175ec95e23d966eb1a812e4336edd385
- SHA512 3adc25ebf6b24fefc2c244588a7996117781faf18b2ccb270719b9183a453978dd43a4e2bd3d3853e6adf7e210ef01d92d65855458c0cb81068c462ea86196f8
- SSDEEP 6144:RqlIyFESWu0SWuGSwxUIjNDv0bNXkbvLx:ty3IZGNXkbvLx
- MD5 SHA1 SHA512 SSDEEP