f284acde153e1495e7a7054b0c040aa9e8cb9409ba741f661068c2b07d5d1001

General

Target

879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
Size

77KB
MD5

879e0f90cb2708bf342c4daf5c06c7b0
SHA1

4005169a0f7438816f0b3aacb228c6a506cf3e3a
SHA256

f284acde153e1495e7a7054b0c040aa9e8cb9409ba741f661068c2b07d5d1001
SHA512

4c552cc1a322884421aa25259febc388d29fc898217733c68386cd8fdd91bc2aba2592c31f3b1fd69569fd6a272338e62e7f091fdfd2b60f82234af5723eb21a
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/t:6e7WpMaxeb0CYJ97lEYNR73e+eKZt

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5007) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\CopyConvertFrom.tif.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp	879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
77KB

MD5
2700e0e4706dc38e555fd398edaa3803

SHA1
d33c58d4ef1ed08a23c872b92974d243353d5715

SHA256
94d3fb3e5da288ac18672d1a6b029c0e7f4381532c96b4b699bc405898c2e227

SHA512
dee388c974ad373bd4a1c1b8eee9b8161e7ff3d627b15526691ff7a9427a72c65c60528410fb9d2f37ff5439f9c3cb0e681f90892ee9d695cfc6fbc47d7a3fef

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
176KB

MD5
ba253e78138a127556b416464aa7076c

SHA1
2abd925b0e2eade2a946561259c3667257a3f37f

SHA256
0ca4324ac667c5889dfcb1906e2c483a455b80f7a9b018bacadd639534703111

SHA512
9dae2cac8da3fc6e9f4754054be1f046a54e8ebce9afc7fa636d4c38927b2f8027deb6c333fe96e24c73628962293873f7b6b86aa15cda11f8aa423b5917352b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads