Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe
- Size 53KB
- Sample240530-3grr5aeb8v
- SHA256 8934da192711a8b5ab6511468f7d329811476ca4875dbf4d16d8296f16a75cfc
- MD5 6cf65c0d66238caf4490519d60261d20
- SHA1 ae468fe76f76d768d04e6f9b6a476702cc793d87
- SHA512 d7b5a4130d2a45fc918d60979130871be0a47ac5138525f259457e888b735fcaa44c5445abff1cb9277ac09e6190f71e7bd2cabb72e93215c44bd66e3baf20e6
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nDqA/JepAYJyqA/JepAYJ1:W7ZNLpApCZrt8PWGoPWGANdNw
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5015) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-180.png.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial4-pl.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cldr.md.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-pl.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sa.txt.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\cs\msipc.dll.mui.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\mlib_image.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\local_policy.jar.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceProcess.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ul-oob.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-timezone-l1-1-0.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_F_COL.HXK.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Controls.Ribbon.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusDemoR_BypassTrial180-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp 6cf65c0d66238caf4490519d60261d20_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp
- Size 53KB
- SHA256 ea08258be1bda1c48efa6d8721fe9f8207ace013fa2b4e32648b49b74a9a290b
- MD5 dd6a4c9d5ce282afb9a56096a85dbfbf
- SHA1 493ad83a859425b9aada4b7fc381f3d1d62774c1
- SHA512 deb6888b196f2767d46c8ee5d7252f7e27e36fc3cbdf48b3e060455decaf14f1712b05279d53f7fbbfb3b6b82f7eb411569224862e857787ea9373b25c3428c3
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5nDqA/JepAYJyqA/JepAYJ0:W7ZNLpApCZrt8PWGoPWGANdNd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 152KB
- SHA256 c55c0bebb96e72a18c260510794e957e44af26c607fae052949834eaaea2dac0
- MD5 667ef869614f4ce535d62b2406c22bbe
- SHA1 8b0ee6ab291e8a37eae2c6727b56c634b20f9ecb
- SHA512 6c2729ad971ed67c826ea4b585cd8c7cc4ef8d193616f9a3fcfde8405b14b456376672d49250eb8f3f3e544ffaf80ef0aca0bccf8df263544612b532375a69a8
- SSDEEP 3072:6NLWpCZIzLWHIjN3tj6qnv0b2UrXkbvLd:u6uIjNDv0bNXkbvLd
- MD5 SHA1 SHA512 SSDEEP