4a34461c31290425fc76f1745148c1a566a7d6040a115eb1c57614646e9b55e5

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
Size

90KB
MD5

dc4bd4bca527681e55c8f0a2695a6ec0
SHA1

c3aaf67d7afbf9aefcaf22706bc668df5a1713bf
SHA256

4a34461c31290425fc76f1745148c1a566a7d6040a115eb1c57614646e9b55e5
SHA512

1e1265bc9e547da65ec32b37a17307348858a2e7688ef12b6c1c145fb6a3d9826fbb0491801a876c20747cf8db44bbb8729fbf6320607a17a1433b6ce54b0d44
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/ejJZJ7r7raRHBRHY:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0zKO

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\dtplugin\deployJava1.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XmlDocument.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-pl.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationCore.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogo.png.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.ini.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ko.properties.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsym.ttf.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri-Cambria.xml.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote.gpd.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.Extensions.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ul-oob.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClientSideProviders.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\decora_sse.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-pl.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\javaws.jar.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dc4bd4bca527681e55c8f0a2695a6ec0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp

Filesize
91KB

MD5
f4938073fa24a8276a8ba4c7ecb838de

SHA1
5b13237d60b3c5589661f4225346b120ad5fe11c

SHA256
9e8f6a02777a5af036afd6675d3e281ae705c19576bd10b0b8f58542597ae0fb

SHA512
67243a78d0eabd4b57473728a81f3b82b00f3de614f1c6d3f8077c4ba9af889764934fc38c30bf32751042688478aad0413d5ef821bcc2b3a4ef7ff167650ec6

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
189KB

MD5
ab32f82adc63ca0b7c7af6f7ce9c857a

SHA1
526ef6806585d3178c224ba438e286e0369bbf40

SHA256
fe88ff2550484a85098e6fa1bab1a92827d314970ad3057532a8422dd5895e0c

SHA512
201d0eb22042225e44d8da21c30fc663e0cdfbc7567e05b15fbefdff919c31f75cbfcc9afa9214b7f71aa54de00bed91f60ad7d6832222c99d9396f9c47df547

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads