Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
01/06/2024, 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe
- Size 94KB
- Sample240601-2ekelahf62
- SHA256 eb2ef4916db76f642ab8f844ba918ad87c26f72f85f35902a43785c52fbfba6f
- MD5 03a51ad7306f401ac5f20ce4b85959d0
- SHA1 ba6511757e63a585f7c8110f5ef8cb72a6d92ecd
- SHA512 b4565c3eb99f8af1ab20aa470992eb12d66b54f4d5882445086f050cc5a4e61cbb25ed9dfd6c550f9379a59c4ec4d098b74d39eedd0dc62e14db6a6d68750c2b
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Kg5gV:6e7WpMaxeb0CYJ97lEYNR73e+eKZ0
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4836) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationProvider.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXmlLinq.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClient.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL027.XML.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.cat.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationCore.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\WindowsBase.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ul-oob.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\powerpnt.exe.manifest.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ppd.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\preloaded_data.pb.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Xaml.resources.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\bci.dll.tmp 03a51ad7306f401ac5f20ce4b85959d0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 95KB
- SHA256 a3555d214bea2216c5ff6908fc2ac706f0bf01554b2a65c88ffa1cda1898ae83
- MD5 1ee88e90b02acdc542ae7e90ea595698
- SHA1 1da2dad87a32468de9f41525915f518715812d67
- SHA512 404038122673aa601592f183f741bc124de6883fa6268638ae5c06f9358616bb870241cf7b6ba8a494b7ca8c263e5999da8ebe00e87ada519d48040a982f5c8d
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Kg5gC:6e7WpMaxeb0CYJ97lEYNR73e+eKZD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 193KB
- SHA256 85aef30f3c4ddbe2f5ab8cfd2b817a74f9441b64e94f1ebdf0d943844930ecd7
- MD5 2c3f293c9f23a635481a45fbdd3726f3
- SHA1 014b3a8eb86096f22076103d1b444742e749e897
- SHA512 719d8db245bbe4224f1059ca68add8af2bb4cde75e55ccefc222058c32a88cbcb8a6885e8e9fada7bf10b11492e6e1e4a1676f9a02f07ac1f910a1e7c02bfc89
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZ9WHIjN3tj6qnv0b2UrXkbvLZ:RqKvb0CYJ973e+eKZ6IjNDv0bNXkbvLZ
- MD5 SHA1 SHA512 SSDEEP