e6b218585de843f7ceaf0ebce83fcb2cb24ccb0e6f9be3c9456710d392cc80e5

General

Target

07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
Size

86KB
MD5

07cda12ba4125327f36e3f30ae5f10a0
SHA1

644249b8036cb268f542f96ed1ebd7daa7e2405b
SHA256

e6b218585de843f7ceaf0ebce83fcb2cb24ccb0e6f9be3c9456710d392cc80e5
SHA512

789e18c3440e379266ab0ffd2681c7cf15b6c3d2265ef3d28a8e611f946f46ee577696847755c767271b5756e189f041bdc316458a80ef5ee5231cdd15d1eb2b
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhX:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsK

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-pl.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.DataContractSerialization.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\manifest.json.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Configuration.ConfigurationManager.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_ja.properties.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-phn.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Input.Manipulations.resources.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\AppXManifest.xml.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\C2R64.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\thaidict.md.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\US_export_policy.jar.tmp	07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07cda12ba4125327f36e3f30ae5f10a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
87KB

MD5
62a744492d98b115878a4ae8f1c1690f

SHA1
6fc1e42018830a7687ccc3fd9f64aceafe2a63e6

SHA256
549a3c1ed066f916d65c51566dec0afca7541b61be895ba2974cd481451e7050

SHA512
92c6c4a7741ad17746ad52d8fabd0987e5e5091611acfcc034a82d335e37a4beaba6c7bc396dad81a7bdebcd6df14e1071b0548c03645bb0f3ad2eaec967197d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
185KB

MD5
cd58319f8477e43647b60baf5173a11d

SHA1
2ee182720e0238aa54f6d29dd1566d212c39b73a

SHA256
394165c7ddc909e4df5a8ba02ddd55b5e7b39bd81093edec5746b8ab2e57786f

SHA512
4de6222cf21d8610c1c18d0fa8293cf4194fd52e3fd77c5bdaa97e082b355b191fd855877f9ad6ab9e55b9e49603ab0d1696491d078546b10dfa629a5648a026

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads