Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe
- Size 91KB
- Sample240530-ra4bssca96
- SHA256 3d1f0364f4841a154192115ea672cdc8d2750635ac0e7b221da1ce6d2ac0e513
- MD5 067e55da36d09b878df8a07e384861b0
- SHA1 f6671b5d086d951e5ff7b1b466bde300c4228854
- SHA512 275bd6d8ff62e24ff9ce296e99082063f0d86600ff8a1b487bd2ea44e1771c7a45e3b7b6481036e0463639661cae28ffdd08ae2ec7cda3a377fb27f332562fc4
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaqvvJDBU7JDBUy:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXO
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.Primitives.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-ppd.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ul-oob.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceModel.Web.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ppd.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationClientSideProviders.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable-dark.png.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONFILTER.DLL.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationCore.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\nio.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\excel.exe.manifest.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-datetime-l1-1-0.dll.tmp 067e55da36d09b878df8a07e384861b0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp
- Size 91KB
- SHA256 eea8cd1910a71d4f71d2a5f3628b767373536ebc624bcdbd5aa5e1ffbf7c5b49
- MD5 619924d0415ac5941eb0e19570e813a3
- SHA1 51fe4c6c65d866d701baf09a6d86539f801297a5
- SHA512 a1ea297b7b5ead2b6a57a4ba6e3cdf24dac06cc68f6aa90d4f0472d3cbeca3c9b53c1a3e2b596f6f985eaf54106ecc1dac19ea79fb58a927e12addedc0be679b
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/0VXaqvvJDBU7JDBUv:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 190KB
- SHA256 680940652879a9c9c080bd29692f82b7334446a1edb1b4c008cf9e6bcff9f8f3
- MD5 abad0a8af9c2dd215b859e1216c68a75
- SHA1 6b0e151b1e760c29d43b9dd06752c5230d5fc1ad
- SHA512 bcd6ea3245bda50f59ea96f5d4d127363fc5fdbc7621a5dc7d10a18574ff68e2e44ee6d48b389e88b7a129d7f08795e7b3f33e85cf5a4794237f4d1cbd10b018
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0VXaAWHIjN3tj6qnv0b2UrXkbvLa:RqKvb0CYJ973e+eKZ0VMIjNDv0bNXkb2
- MD5 SHA1 SHA512 SSDEEP