040086b4a8cd94228f6b045c0350b18864e992e6a0cc08136c4d89c6fafb1e2c

General

Target

72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
Size

79KB
MD5

72daca0a79fa92d7cfcbf5c5ae4f1a10
SHA1

e8b2ae788930287205f90b0af427e61938ab1f74
SHA256

040086b4a8cd94228f6b045c0350b18864e992e6a0cc08136c4d89c6fafb1e2c
SHA512

dbc5f6a63c3f47514c7ab5c4957653b0a309796acfe956689f3082ce4f34a2ef79270e7dfedf62cf5748f50cb5c3f355aa1e583588960fbef33619cf51bb1720
SSDEEP

768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHX:W7ZDpApYbWjIlE77ufL2e+efZwZavr

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\msvcp140.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.excelmui.msi.16.en-us.xml.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\orcl7.xsl.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\INTLDATE.DLL.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Controls.Ribbon.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Organic.thmx.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.SapClient.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationProvider.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Input.Manipulations.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp	72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\72daca0a79fa92d7cfcbf5c5ae4f1a10_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4036,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Filesize
80KB

MD5
ed8c4e14c9b837b790717994eb30a099

SHA1
9f5fc133ccb7bfee364fdff3a0a053130dd78f5f

SHA256
4df46056e3af9d137e9f0e4db36a35f5d86bf8df0abee808c8d16013fd3070ee

SHA512
d3cbbb8ac5faec86f5f4017d251ec7349444c0451db11e489fbbb6cc2e906c054d2c4e424e7d7a9bbb549c9a6925277e7fa5fd5a3b04874221ec209cc7bd74b1

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp
Filesize
192KB

MD5
1eeb1cf2a108103b76390e07fc0cd358

SHA1
12836bf64d58d82cfda8bea7e768259bf55ba952

SHA256
5fc3738935166cb66b05ac86217838a398d9e20242443d5eb00fdefebe5d4463

SHA512
982581813e7d69fc8858cb06506d1e4c06f5503b811683565a060da137419f617e5e8c751f6e943030d7723149b8eed7b8c78a480f1f124bb04e3b866fc688bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads