Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe
- Size 78KB
- Sample240530-26ey7aed97
- SHA256 a5a8d2f2bfcccb3a5f98b2956210aa506a3ff72bb2295c1bf896cdd42ab29b0d
- MD5 6c69943305b227369f3c945b1c6d1720
- SHA1 2a5eda5dff84ca78ba2ec3ab787e4a4ed9c41ed1
- SHA512 0e78119573a08b91d829162e00a1cacb20ec5ae61e5f6e2693863d49ce9a6a65a4bed56f5a6b8ac783d2aad4ef0dd978c382dde8fd9eeac3a20e77edb14a6bc8
- SSDEEP 1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696xZ9SrSj:6e7WpXYvndBSrSj
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5005) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linesdistinctive.dotx.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.Forms.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\EUROTOOL.XLAM.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\tipresx.dll.mui.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Design.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\SAEXT.DLL.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Xaml.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-80.png.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.DLL.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\cacerts.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordaccore_amd64_amd64_8.0.224.6711.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 6c69943305b227369f3c945b1c6d1720_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 79KB
- SHA256 25407f5873ded39c9d38e3f0c8244d808d97c388e31cacae532336e5ea1b0c66
- MD5 f6737d274567ec3a02b30c8cdfd47741
- SHA1 fd1f13fd94cbec28a50f52b28ca9d2298f453345
- SHA512 76ee99622ed232b6c3c8c18e684d54ba00b6a923ae2425bba542410004e87e7c455fb1cf1acd02ff396bb54af3741b7a400dd2ec5e2818fc71ff13ed02a129b1
- SSDEEP 1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOM2kJOMIsKsc696xZ9SrSR:6e7WpXYvndBSrSR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 177KB
- SHA256 09414edf366243a290cbe0f9b2a5a72b01b33f0d2acd51dddc65edbec81fb679
- MD5 20cd7968fb1316ebadf2aedf445a5f59
- SHA1 8fdc2a954b581c3ff5afc3c5e84ebbf78c3f7a18
- SHA512 ba14d8321eb9d12775542e65dab1c07a204659e9651f7308206907d8c06ff2c91d2c7cb66ae97d5441f8df6cf8d2989596daed5319f1d10c026d26665b3ae5d3
- SSDEEP 3072:6e7WpXYvndBSrSPWHIjN3tj6qnv0b2UrXkbvLq:RqRSrSrSEIjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP