Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 23:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe
- Size 74KB
- Sample240601-29pykaba29
- SHA256 31f21f39a4b01cc866a79b826e4fc766cf9f50496f7b5a4637a107d9855cc8cd
- MD5 093ad46054d41fb8cc4c0dcb5fd87740
- SHA1 b20da57797318b275cf923ae0eda17f2add7a5f6
- SHA512 e6129732a64aaa10c0229d9c8877df2cc8b74fb10b7c3ec2188f81189b8e4dc9d760fd507fb734df5b03670657b1a773a17b3a00ec7d61877f5683b1f809f2d4
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69X:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mG
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4859) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\LICENSE.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TextWriterTraceListener.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\HideStop.gif.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationProvider.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-ul-phn.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\YEAR.XSL.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pl.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-pl.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt-br.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ReachFramework.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationTypes.resources.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Xaml.resources.dll.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 093ad46054d41fb8cc4c0dcb5fd87740_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 75KB
- SHA256 ecc1f0b351eae10be8cc5420224f78d21f70e08a532e29b8530fb4707c00ad32
- MD5 f7c668972b23d6e6ddc58667896b196f
- SHA1 40fca446ad65e34d105f008e834f84fca5f71663
- SHA512 bc17b7c0d3ed8329d0da799596e2d9086b5c62017d03683c763a2f27d0a9f99ec622a765db7251ffb688480a62aebc45bc36a2ee4be49fd4afd55ae3daa5e0ae
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69K:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 173KB
- SHA256 c3bbeeca5102d69dee19f2bf7da78bf03176b93bb26cd3db9a9a612c5548c4f5
- MD5 924a20873e6ee98ec009730c2fcc2b99
- SHA1 88063a18a899e9ecfad8e1d72ce608075bb11543
- SHA512 c0b69289ecf06c3769b91d6e98c6186516d5720bf84a40aba27d8fd21beeb8ebc5609d04fabce741040375ed7589ece097f85645efe46ac0714b78e8e96690fa
- SSDEEP 3072:6e7WpP9oVLQthbYY9oVLQthbUrt7t5m0mdWHIjN3tj6qnv0b2UrXkbvLG:RqAZIjNDv0bNXkbvLG
- MD5 SHA1 SHA512 SSDEEP