8822e9d31a1affc9b0855f15b3cbc2aab0b18870fb9f2be4f95382a6eb7d7761

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
Size

77KB
MD5

3a237e29ac3bc2b94ceaa02f75bd9bf0
SHA1

f68bcc384f78f00ecc3c1850d4f5e8504e62ef8f
SHA256

8822e9d31a1affc9b0855f15b3cbc2aab0b18870fb9f2be4f95382a6eb7d7761
SHA512

5ad7cdf9db4da044e5da3cdc9ae15a9f94f597c324a5b04c8219888e775fcb9204222e0deadd61f62963613dafa090be153e9f04863d78efb0e5a6536c721f9a
SSDEEP

192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7GliGY61Y6q:GBt7Br5xjL9AgA71FbhvoBlLLQ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-oob.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.runtimeconfig.json.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationFramework.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationCore.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dynalink.md.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN111.XML.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\WindowsFormsIntegration.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.bfc.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp	3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3a237e29ac3bc2b94ceaa02f75bd9bf0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
77KB

MD5
8ef57d42949dc634561cddc53524ee5a

SHA1
b3852ab31066d68921655ef45b3b2090e1e51c65

SHA256
fa6be03049179d7e233467c8945d8b3ee0cfd84bcf3e774cc1507370771644e8

SHA512
1124132e749e5da5642bdddea7ca49c6c9bcf11a2133bbd12389f5659ad6758024593d42dca33e2d06bba239954ed4282aafbcdbda0b357369fc4aabc18e0412

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
176KB

MD5
89191c8d3c39dd2a44b3426055a5613b

SHA1
18e1494f14fd1fa009ad2d37df64dd0bdad1ef4f

SHA256
aea6b63da3ab3daa0d757c1dbb54a3bb5b13b7084b9184685e9fbbbdf681ec0a

SHA512
fc9c5c2d261c9406a1bbe51fd11efe5f933cbcde97b278ee8d5176385d725affa778e0cee049c40326c9a0fe26b8922367b5b6faccefdd321be50cf1c74d8edd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads