Analysis
- max time kernel
150s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe
- Size 77KB
- Sample240530-fb3wwafa5t
- SHA256 2246f73d383f0df3f8dd77e8250faaf6a38225899e4fbdf4cce1a4817885df2f
- MD5 64fdc49ccfda0ee12dbedc182a459d30
- SHA1 6e672926bfe483ad52a55cf94e0526711080a0bc
- SHA512 f9ebc49bb03917798a94cbb838bf088bde5299105537a7d4644ea0315aaf2b881cd53c5c0aa3ef6b8ff7b8845ce2628a4fc0808948ce2065bae85d6a3f2ce329
- SSDEEP 192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7GliGY61Y6e:GBt7Br5xjL9AgA71FbhvoBlLL8
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSQRY32.CHM.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.dub.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TextWriterTraceListener.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\meta-index.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest-pl.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunec.jar.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 6.0.27 (x64).swidtag.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Design.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Web.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Retail-pl.xrm-ms.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Xaml.resources.dll.tmp 64fdc49ccfda0ee12dbedc182a459d30_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 77KB
- SHA256 bd182b680d1cccfa34166e3df9dda2798c61a30c2dde41456f30712906c45727
- MD5 d6a9d40eed1a8fdefba7aad5e62a26cd
- SHA1 9e9afc54e6137ac1317007416beb3e15b42a173e
- SHA512 3367713fd8fefe3f3e55afe7310c9824d298c8164928e86686966bc5d65c304a0d465be11ecd6d7c1d04c6faa29abe9736510814347f2c434c8ae24d1aab929f
- SSDEEP 192:tACUADIY0Br5xjL/FAgAQmP1oynLb22v29HWvHWY7GG7GliGY61Y6i:GBt7Br5xjL9AgA71FbhvoBlLL4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 176KB
- SHA256 6e0fef7bc75366442bf83bf553ae1e4cc5a162547252ab22e58f609dcf4b0f74
- MD5 6a3f44186a6c484671318ca91efa7c40
- SHA1 55dbe9e242db26a8e3f1f4ff02a15a7a37f0c8c1
- SHA512 c2a8b951f32dec6782539162c8e2a7ce253bda172146c35e3dc866a966073ae255b984a237fab619d26c00af295fd2ed96a6611a3525581410cee417bf117a9f
- SSDEEP 1536:W7ZppApj4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DdE:6pWpSWHIjN3tj6qnv0b2UrXkbvLu
- MD5 SHA1 SHA512 SSDEEP