7dfb56be415e9c05dcc279c860de1c595427166ba29177075d3e43ec4f297957

General

Target

62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
Size

81KB
MD5

62af7ff3292dc88e05cfea384255b0c0
SHA1

13176577424119a161e84e3a92eff285911c90ff
SHA256

7dfb56be415e9c05dcc279c860de1c595427166ba29177075d3e43ec4f297957
SHA512

ed17f6be72909ce371331e797f9d711735a68356ce791277ef1a5e654803180ff308ee137174ae93654db9ae47b093c7ecdebfa081a5735fa6db8db77189746f
SSDEEP

384:GBt7Br5xjL9AgA71FbhvoBlgkyls4YSc41Cl84X/kyls4YSc41Cl84q:W7BlpppARFbhKH1MHI

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5106) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ppd.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\TecProxy.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-pl.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelTellMeOnnxModel.bin.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo.png.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdaps.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\fr-FR\wab32res.dll.mui.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VVIEWDWG.DLL.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp	62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\62af7ff3292dc88e05cfea384255b0c0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
82KB

MD5
046839bf08a8a0e2aec85988402126d1

SHA1
f3bc6f5007ebe2db32601473cc16738f809bfd8f

SHA256
0c7c821303474e9c41bb2256af099dd423bc052242e5f4607398d876bf1cbf60

SHA512
b78caeb13b34a9f23454bfe91dad6b384572f6fd483a095eca9b9186c046fc8dc04d362393b5f91611d84a57d7fc4b2ed606caf134cf6ea6fec40ff6c4fa6cef

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
180KB

MD5
0ffa4f5e104827f6abc6b1680c06587c

SHA1
0383530847fc3e1633448062a177c695a309ddf7

SHA256
9e5e25eb07284d6a0ff17483e86c3d834b3b35103100da535a0091b3fa930aca

SHA512
4c725612bd5e6a26e6677c0879b8d6b0a219f8b3f4fa8a2d2125cf3563488d9f0496664feeb2a72f9eba379226594e0b51ab8ea706d4ede461f5a8f16048806f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads