Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe
- Size 88KB
- Sample240530-2ns34add97
- SHA256 a5f9af273dc4e5c6eebcf6d31b19d7806f6669cfc45a4dc64a33f2cc5f20ec01
- MD5 6b6211ad7136cdca4fa7797767eb9ab0
- SHA1 640bdf50776928c193954f1a6ea8d9a0955892e8
- SHA512 bd741c8200e1a9e24b1eb3c2a0a3679dbd5bab83795930a393ad9d3630a16458e44dcf5b35578257dedbd6daf736e863686b0494027efcc2f092980d29887146
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/g:6e7WpMaxeb0CYJ97lEYNR73e+eKZg
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4707) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ONBttnIELinkedNotes.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\UIAutomationTypes.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ppd.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationCore.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\FindSelect.otf.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\ZeroByteFile.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicudt53_64.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\lv.pak.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ppd.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.HttpListener.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ul-oob.xrm-ms.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp 6b6211ad7136cdca4fa7797767eb9ab0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp
- Size 88KB
- SHA256 2029bd78fb132b2fc93c53214c9ea3d9910b3efb65c42d9014dd69833d649ef5
- MD5 eeae619898bab162dce42a1070fbe608
- SHA1 5d20572e5d2ac12fe019bc3d13474796508e7204
- SHA512 d178245e310dc96e794f74183b36157cacd60d26dd9718a5bd9278732a05d2e7612dc2a737cd9a139ef937fe38a94d67ebad980c2b87b817060b010a17c07caf
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/P:6e7WpMaxeb0CYJ97lEYNR73e+eKZP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 187KB
- SHA256 f165064f92bf7191ddc5c391e44e0f321f1430f6337cdf7ea980e572f04a7d98
- MD5 b566472bc4eb094d1aaa4d246f1de4ff
- SHA1 a7e9b63d4c7cadecffd592d1e3f97ac29dc8cbea
- SHA512 f41fb24ab4049cc6f333598c21b40a8acaeb5398ede007049d5c0e93fb883f9ef2edcf287cebeb8edc7ba9390ef68092fb650a6c7c230105f2baceb9758938fc
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZBWHIjN3tj6qnv0b2UrXkbvLj:RqKvb0CYJ973e+eKZ2IjNDv0bNXkbvLj
- MD5 SHA1 SHA512 SSDEEP