Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 20:59
Static task
static1
Behavioral task
behavioral1
Sample
879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
-
Size
77KB
-
MD5
879e0f90cb2708bf342c4daf5c06c7b0
-
SHA1
4005169a0f7438816f0b3aacb228c6a506cf3e3a
-
SHA256
f284acde153e1495e7a7054b0c040aa9e8cb9409ba741f661068c2b07d5d1001
-
SHA512
4c552cc1a322884421aa25259febc388d29fc898217733c68386cd8fdd91bc2aba2592c31f3b1fd69569fd6a272338e62e7f091fdfd2b60f82234af5723eb21a
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/t:6e7WpMaxeb0CYJ97lEYNR73e+eKZt
Malware Config
Signatures
-
Renames multiple (5007) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jdk-1.8\jre\bin\jaas_nt.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tracing.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationProvider.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\CopyConvertFrom.tif.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140_1.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office15\pkeyconfig-office.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadco.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbProvider.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\DirectWriteForwarder.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\tools.jar.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp 879e0f90cb2708bf342c4daf5c06c7b0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmpFilesize
77KB
MD52700e0e4706dc38e555fd398edaa3803
SHA1d33c58d4ef1ed08a23c872b92974d243353d5715
SHA25694d3fb3e5da288ac18672d1a6b029c0e7f4381532c96b4b699bc405898c2e227
SHA512dee388c974ad373bd4a1c1b8eee9b8161e7ff3d627b15526691ff7a9427a72c65c60528410fb9d2f37ff5439f9c3cb0e681f90892ee9d695cfc6fbc47d7a3fef
-
C:\Program Files\7-Zip\7-zip.dll.tmpFilesize
176KB
MD5ba253e78138a127556b416464aa7076c
SHA12abd925b0e2eade2a946561259c3667257a3f37f
SHA2560ca4324ac667c5889dfcb1906e2c483a455b80f7a9b018bacadd639534703111
SHA5129dae2cac8da3fc6e9f4754054be1f046a54e8ebce9afc7fa636d4c38927b2f8027deb6c333fe96e24c73628962293873f7b6b86aa15cda11f8aa423b5917352b