9610d56f91e9f3bee6d6617c48e761e3721cb83abd76571deebab7108f001865

Analysis

max time kernel
150s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
Size

87KB
MD5

187b1afa92e68ec0456f04188cd6f0b0
SHA1

944c6dee2341855ee1588c79721b31021f6ff332
SHA256

9610d56f91e9f3bee6d6617c48e761e3721cb83abd76571deebab7108f001865
SHA512

bf4cf02272974a2f1ec5222a07c022ed0455273e4ef7132d7bb7be113a27650eab61bb9d72fe424000d860ea020324115541776eefb0dde1a584a5193c12d50a
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/aJaKJawHCH8Eq:6e7WpMaxeb0CYJ97lEYNR73e+eKZM

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4811) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Channels.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnvpxy.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationUI.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHMAIN.DLL.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\PUSH.WAV.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Invite or Link.one.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClient.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.resources.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\187b1afa92e68ec0456f04188cd6f0b0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
87KB

MD5
526074da271f9255fea232c901936cf5

SHA1
d0e15cd1e25d811859da1b2155dc0942f1e7b82e

SHA256
25a03832e0e18c9bcc954cd2b6640799e5521810a7a3ee233ab3330bda600973

SHA512
8ec7a4657abf9298463837e445ec1d5d7dd88c9de1a07b3f9b8ed49ddd9b136464df8765386128a56ef98d94ab961d4035721fd8c13141126eacf002ce92c391

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
186KB

MD5
bea65ce4c40f21db42f0e708c6265482

SHA1
b01470fa61a502d00b82257e5f7c0713e6c3a6fc

SHA256
e4026df296a9ce323980948a3a075f0947e83ab4e5adc16fd3c66a55ffcf976b

SHA512
e78939c9e3a01ca6f5dee1a964570ae5f7d5136e59e73b9838a5a8aab8d4ac5ea7b467ccd50ad04e0a20ef7a5c6402f3e1d50000cdb9619bb63b3158bda16254

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads