Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe
-
Size
52KB
-
MD5
0dcd221f543a149e248a8dc1e69b41c0
-
SHA1
6b39a03a76166543c46b2bf2db61f50b0726fc14
-
SHA256
d08df1cddc480e244e7ddfea75e04762333a92403a8ccb55f7e06ba892aaf168
-
SHA512
b4c55fc5b0ddb326aff4c279213105917e4865fe23b2b9e0a21ee2bc65bae787ed0fe73df25b9d314e12ff1f918c4332d2c2e8c1f79f9a5f70e5b8202067ea09
-
SSDEEP
768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nVJpQJpN:W7ZNLpApCZrt8PWGoPWGANdNVJpQJpN
Malware Config
Signatures
-
Renames multiple (4870) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-1-0.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_common.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-phn.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClient.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationTypes.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Xml.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lt.pak.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\wab32.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.NameResolution.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Input.Manipulations.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl64.dlla.manifest.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jce.jar.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Cng.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Json.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlSerializer.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ppd.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ospintl.dll.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp 0dcd221f543a149e248a8dc1e69b41c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD521b5e5bbc2c8f8c19264c0b71faece58
SHA156af08e64d241dce37b5779b10d55bc530a594f0
SHA256636b90174dca62513143adc1f671f9bed25d028f61a5a4369c78713a8c452dbe
SHA512992dc1b8e5311a370fa0739c5c481d43aa8be9c23bea262904f7cdad13d8ffc398ae12e400060b62084806329c0d4a70dd4dd68d2692e8e4ca94debcb7ff61e5
-
Filesize
151KB
MD56d701bdc44115caa40d2fecc56fa229e
SHA18e359113515d1182bac7412c36e7a23694c2193d
SHA256dcf49543bbc4b267a6fdc8ce1eeca8635513b04a7831e87a53335f4d7726f716
SHA512368d832c2888dc720cee7deef34794dabe691b137e10eefb54420c09a79936af32c7a5521bb0f33c24239981fbd8f64901c09a73c02eda24675700008b1ae23e