b9ba37c771a4a04ae355e5afba2e606c4e18bd414eb21385d889163b788085a9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
Size

70KB
MD5

ae14d8bfd5d67e9181b232a34a7adb30
SHA1

9a7a16b110955445f26388cb45924a6451294656
SHA256

b9ba37c771a4a04ae355e5afba2e606c4e18bd414eb21385d889163b788085a9
SHA512

84749479aa0e6a98c2e8b0d80ecdc296a79a4912549b157f75e571b6e650de3b16c41dc07e6faab3565e4a32f0245bb5e7360531342cc37219a6a0d34121521d
SSDEEP

1536:W7Z9pApQESOHepOHe8G+6E6DGsTdc6e6kvNDck7Tdc6e6kvNDckkvVv/UXZC:69WpQEoTdc6e6kvNDck7Tdc6e6kvNDcP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.DataStreamer.Excel.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2ssv.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clretwrc.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL020.XML.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-GB.pak.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Riblet.eftx.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.DirectoryServices.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jsoundds.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\BIBFORM.XML.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.Diagnostics.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\WindowsFormsIntegration.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-pl.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-oob.xrm-ms.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUABI.TTF.tmp	ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae14d8bfd5d67e9181b232a34a7adb30_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp

Filesize
71KB

MD5
323289e9475c1f424e5290862e5b3d9e

SHA1
9fad15fd7b8844e1b49d173f85f564cc2c91727b

SHA256
8cc5959ae5da912f544ef60fad64d8c81edafe7dfdfbac253db57cca43ff4b70

SHA512
fa308f5402d0977a1d2bfa4d404f66bdf76b30b88ea30b14f8950884f4deef80d716fe750c5627a0c0b4c6bad047c7cc6ee8590b922658760b49765b586517f4

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
169KB

MD5
697ad5be704f47ee45b65d2648a6f075

SHA1
039ce0b0973507e03678a20c7a3c723ba17b37b1

SHA256
9272b01900586bb987a47eb0ae85e5ea821f74c5e8f0e050877405b1998692eb

SHA512
76d1023f53c20294b0fbf1aba2a553dabf130eb9cfef8a8e2063004bd18992bd2ecefdd8a798ca7a8ac11bc7121c8e305924ed59f20d4e1718f5e09ed2ff4ef1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads