e21cc4da36e055d51634987308b80bf749c47934f65db964ec59d7c97477751d

General

Target

493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
Size

80KB
MD5

493a2cf5857fce40c86b73a9f5877a50
SHA1

283d27200a22f1f977480adafe129329565931c1
SHA256

e21cc4da36e055d51634987308b80bf749c47934f65db964ec59d7c97477751d
SHA512

ad5073a49f196500a9ae9e1610220f3d3de0d1c5f6e3edbbd03f6b7cb5d8e5cb8a7e88a2755082529aceebcae5ba551e1255bfa27e117ea681934717e3f800f3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/H:6e7WpMaxeb0CYJ97lEYNR73e+eKZH

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (536) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\tipresx.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\WindowsAccessBridge-64.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\IPSEventLogMsg.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcfr.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\tipresx.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VC\msdia90.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\tipresx.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_ButtonGraphic.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.tmp	493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\493a2cf5857fce40c86b73a9f5877a50_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2444

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp
Filesize
80KB

MD5
4631afd3c495e78678bfb9fb4f5ed48b

SHA1
ab9195272ef87d8d163bc50d3ffb2e10bfaad6bd

SHA256
df4977d1934bc1acc7aef6b09351923c7eb6cd8535d5a0f1b50b8be8c061e8e9

SHA512
8a81eefe947312871b7b872d74446980a99b1831a8c46f6aa799a3bb93453286f799973a866f330ce3d9349841e06ae31ae7758ae1d91dbb43d51b7359d24b63

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
89KB

MD5
ab1db1d95b34d4fbe86c6aa21f58da1e

SHA1
04726b905e953fc55ed9f4cd8c4a9a97f371abc7

SHA256
e97ce197c14149c902279713d4eab0bb5a9a7838949297a3bae7184a6bd4144b

SHA512
e87c33c5e349c82545054c90caeea2be06791634c0e3b62ff426353b9540f3aa59c2b669c06e9aa09bd1f2fa32b1617dc04ade6ac5686699f7181f9c52baf8c8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads