381dac1fd7bf2ec8ef7f22eb50553b06c8faf2efa7b1910095de15580552314d

Resubmissions

01/06/2024, 11:55

240601-n3e8wsce36 9

01/06/2024, 11:53

240601-n2ldhscd95 9

01/06/2024, 11:50

240601-nzzs5acd62 9

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
Size

95KB
MD5

6a3fa042f98c5e544498061ab114ad00
SHA1

c1993ed23957cb7ccaeab0ca9d8350fc14e417c5
SHA256

381dac1fd7bf2ec8ef7f22eb50553b06c8faf2efa7b1910095de15580552314d
SHA512

13ad88338f4c207374bddd0f227dfa0b9b33596a1f96e0c3143e3840fd2d3d73a1837bbac2ec6b628b0a1f6ae76e54e5c63f94cfd4e170f7c3ce5199cd6eddc7
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Waa1aar89JAJ4:6e7WpMaxeb0CYJ97lEYNR73e+eKZWaaO

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5006) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tools.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ppd.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\POWERMAPCLASSIFICATION.DLL.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Classic.dll.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp	6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a3fa042f98c5e544498061ab114ad00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
95KB

MD5
d5083fc0b021faa014e1447780a11dc2

SHA1
ea347e8968c9ad6c294fd999270f3fbff4ee501c

SHA256
a473392b6522febada9b3ec17c48d28fcabb84dff2ea488d62df2e64fc46b378

SHA512
8a7c4b5c424f641f7c4cc9efc2c3557de6292f9fb43a7c305ec3f46ed4a4cb170b24da9f93575931d8e405698450c8a585fa7728748b4ddb73cc8ef24d0b9292

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
cae519f7c2ae9c0773df123588b11c73

SHA1
f17e77e90c20ca8d1e057ffc13f9e0cb301d6add

SHA256
27f0f8382a0227de59eba0eea5539101949b825e04a6060af8102ca59bd990f1

SHA512
a8942e6f5e4f2b7e623f698256368f6f3e58fd95ef06f3508e7a8890fb7d7f612fa801c2f02c98578d2f84ed3d5505eae4284f471436fc52dc2852850f60cfd6

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads