Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe
-
Size
81KB
-
MD5
eed21ee6e2ac9b5c5e629b2031732750
-
SHA1
d9220105de8050644b633736f3961fec09836470
-
SHA256
96ffe67d45422a7ffd36be1b95608b7014d22afb4abdec76fe75c2b1b0b1fda4
-
SHA512
f7f5c36903fded331e44613d2be8360071dc4e7f53c8eb1daac4895345e5e4d7649fecc5cfa3906e38203e0303525f3310610b0e8d8778189376ac6c5549ec18
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/DfTfe:6e7WpMaxeb0CYJ97lEYNR73e+eKZDfTW
Malware Config
Signatures
-
Renames multiple (4850) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\ReachFramework.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.HttpUtility.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\adojavas.inc.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Mail.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\deployment.config.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jp2iexp.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL092.XML.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\hprof.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_de.properties.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\es.txt.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ul-oob.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-time-l1-1-0.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Xaml.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.resources.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp eed21ee6e2ac9b5c5e629b2031732750_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD58e580a151963102d5d4439be4c8f4d03
SHA12f146dda5a944d53ddfd4b395bfab43973517201
SHA25622988f677e4c53cf43b6d5cee02db3778b4c4c2fd5ea45ca07b49c7330160187
SHA5124b4a807fd3ee7f9711e16471ac2860f6e61823e1d1dc63ce0cd5c42a23ba4002cc8313ba2aef72cb9bf6c1b34ae0856d149ae5695aee8343adc65ce0d39bd6a6
-
Filesize
181KB
MD5a5b1fcb17a799c00fa0f4c262f9abd47
SHA14d79350accfc01a2ab71bc1c2279f68ce599cc40
SHA25643a58808c8a8193177956c1fedfb9a6c7cd67bd80bbe86b415b27cefdb52ca73
SHA512a07b8b97daabf95ee2898bdfa76927e1810665658e6928378c5d1649f22399b95711b8062e9cf785e72d5a1450161acd2fdd3e647717df80ea6874caab87629a