d3964d14e13887c283be8d30647174f2fe753a7b5ce8425ee137457d091fc537

General

Target

6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
Size

84KB
MD5

6caabd357fbe414dbb3776941bc6eb00
SHA1

d8ba7de2a8129626f8cef409aed4f2f1326746bb
SHA256

d3964d14e13887c283be8d30647174f2fe753a7b5ce8425ee137457d091fc537
SHA512

9e987dafbd56e569014cad21941a927a51a177621e75fd014dfb3b80c4803d9c544781b8a6221d1ce16868de75ba7131623308119f7a0ab71a2aca7dc9d83326
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhk:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsh

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4862) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Numerics.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-pl.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcp120.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\ReachFramework.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.FileVersionInfo.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ul-oob.xrm-ms.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Design.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Design.resources.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6caabd357fbe414dbb3776941bc6eb00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4320,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
1⤵
PID:4040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
84KB

MD5
d8161deafa4cd2e6360fa2c3f6c47632

SHA1
b99361e8ccc7a00db531f4d8607ebb9de03f80eb

SHA256
2a61deb4c28061490be6795107151aad71ca272b9f04ee82d56f18eb8956d117

SHA512
8f515204ca2fdc62b618aa593bd5a120d5d649e87136978637ede2a1a87ce55909b3c13e0ae4d9f2674a93f7a00fd60c3913c3433f479ac3e4899920d92bd968

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
196KB

MD5
8eaeba42cb6f372562ef23d39084e1fe

SHA1
93c45c9ff11140417b71b5646db6175660a1a00a

SHA256
77a2a3b8ea7d6fe3535060b27a16a7a7748271b750f578a81735dca9ecbf42b4

SHA512
8a5a5d085878d83ead85a5dd0cbf60a0a668aea61d61424bf3d9effb9328fa19ceff9430bf17e2d18eb245c615baefab93d1f1dd345b5fd578315ef16a729d4f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads