Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 12:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe
- Size 68KB
- Sample240526-n9aa8abe68
- SHA256 95dd07548a7c80d2bded4abdf8e4d824838295a2f089399763d644f1e65e0ba7
- MD5 ea7294029b9761575e3d0473a69cc790
- SHA1 29daa6632e4e2e5d880b5308c5d6dc158cc69429
- SHA512 6307153f240039fd2dcf786ad7d047b82df2b8742320b6ef83b4fe8d51fb042c17ae555165e818bfc02364a1cc8282249605f482cef4ee930e116455ad6c2941
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2FjJk9O7X7vX9O7X7vR:W7ZDpApYbWjCDOcJe
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5033) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\MSFT.png.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL093.XML.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Security.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\lt.txt.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\am.pak.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000008\FA000000008.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp ea7294029b9761575e3d0473a69cc790_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
- Size 68KB
- SHA256 6edd0b81475ddccd62e61ff1ff97730d4c2b596f7a4c5ad954a89246efcfd657
- MD5 6b6afbdf55dfb284796ef1874da626ab
- SHA1 d7b0bbe20092703633285b47ef73ea385e9e92e6
- SHA512 2aa2bb15d7a868f1ef197c410632ccd95358f65b2015b9d0e1253f577a20f83e3880ee6d62a92932880016fdc26b90557d7a854e67bb7f4497db9330b907b717
- SSDEEP 768:W7BlpDpARFbhYQkQjjLaManvFNFO/Ms5Ms2FjJk9O7X7vX9O7X7v6:W7ZDpApYbWjCDOcJh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 208a5a5618b8f28ef0566997c42480ec8d1f22ff638c425d2ad371aebdf8a535
- MD5 8bad72a0ec1b8247697ac5dd06b610b5
- SHA1 6e862046ed7bcb975354401f6a2d254c0cbba566
- SHA512 1018f2e73e61e41cc4266b4b350126e25278e059b4c0d7ce257c992fd68b0f0e7fc966b8d485e0944a4f3dc2e505e406354059d253cffe2cec2a8f25bcd9299d
- SSDEEP 1536:W7ZDpApYbWjCDOcJo4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RM:6DWpeDOoWHIjN3tj6qnv0b2UrXkbvL2
- MD5 SHA1 SHA512 SSDEEP