Analysis
- max time kernel
150s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe
- Size 46KB
- Sample240531-bdc11saa52
- SHA256 a1ab12c46a148fde4dc511245950a54b83417e937e53be95bdacad5b51ea7861
- MD5 706e9c31dcb7a95f082a0812586c7e10
- SHA1 f1b2faceb4d4e0c89852c78949296a155dfd5e19
- SHA512 306fe15721e31f0bfca73bc9f3cb5479f49881bfbe10c47cb1cc6d15c60eda9c7233394916372853585fbfc4f17f1b4904843fe066f8a7379b905db49bad3400
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1Ms5:W7ZNLpApCZrt8PWGoPWG2
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4868) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ru.txt.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationFramework.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationProvider.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-pl.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome.dll.sig.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunpkcs11.jar.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansRegular.ttf.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationClient.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\d3dcompiler_47.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Expressions.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr.jar.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\LICENSE.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-oob.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.IO.Packaging.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ppd.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fr.pak.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.resources.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-synch-l1-2-0.dll.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSPECTRE.DLL.tmp 706e9c31dcb7a95f082a0812586c7e10_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 46KB
- SHA256 dba8f8a7c5285a0330029e3dc4e6a9c2fb9c3e8bb216033b97037fa9eea636d6
- MD5 7a64fd245b1482ac053b455f106fdd11
- SHA1 15ed859e291ee703446fc08f8e9a3b6af6ddff04
- SHA512 ac01422caa85cd3bc34a01e94e534951e969d51da989dc170179a5b7b9d0ed754a7f777c413d229165c5dc9dd6e3befbe12aedc4fcb8bff5931d4d47499a6778
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsV:W7ZNLpApCZrt8PWGoPWGu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 145KB
- SHA256 3995ed6c217efed911180d21eecfa6c7f90d3954b0bbeb1f4c41d44d8137c9a3
- MD5 9a3237185bbb47d0f62fcee8a2bb0809
- SHA1 50c2b3eb728a488403bdd6ca37c40164a56da64c
- SHA512 9aa34e676105fcbdf0741fda2dfe44339e1c611afc94e1087ec678518bd99a8808e1d44923a6c8a8fedbadce80abc90b8360bdcb36273240b056d6603a09e962
- SSDEEP 1536:W7ZNLpApCZrt8PWGoPWGF4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXkk:6NLWpCZQWHIjN3tj6qnv0b2UrXkbvL0
- MD5 SHA1 SHA512 SSDEEP