Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe
- Size 96KB
- Sample240602-abddbsbf2y
- SHA256 e1dda515d12a55c3cd8a5d38832e244980a72f447257f3b9c8898c98b09520c9
- MD5 101266b3943c3adeded05d6dafcc8150
- SHA1 7aa8090931ed8c1f65015a24ce9cbd23d9cfe0bc
- SHA512 c61c26023532d6b2352d269b3664079eb0fe2455d501cd2d797fdfca979187ec913d44e770b9f4a9cae479243a09fd82e23f35e548ad27c5514a69e543d0e407
- SSDEEP 3072:6DWpDWYPxPTJe4cjWEjWqR/D5zf6ydyf+abMkF24kzK3jbrCkoRJNDNR/D5zf6yf:dDPxPTJAj9jx
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4720) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\trusted.libraries.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-pl.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jaas_nt.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000C.DLL.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationClientSideProviders.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsFormsIntegration.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ppd.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.Common.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsBase.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.X509Certificates.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Forms.Primitives.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationUI.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.NonGeneric.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationCore.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Input.Manipulations.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\LICENSE.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-ul-oob.xrm-ms.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 101266b3943c3adeded05d6dafcc8150_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp
- Size 97KB
- SHA256 d31daea71978751e30f40239edfa2b0e500c87d920fb017efbc07f8192df719a
- MD5 7c6cc908dd6d2a18109f118aed43be4a
- SHA1 6ef2861d1fef239d92a639dba4bd076d4193261f
- SHA512 5866dcecde9a77dad0bfcf44881f75d988ed574970c3405e332667638f2d712478e11257d554250ed1550ffc27e99ce51937704b8e3a0ca2db0bdefba2f2d920
- SSDEEP 3072:6DWpDWYPxPTJe4cjWEjWqR/D5zf6ydyf+abMkF24kzK3jbrCkoRJNDNR/D5zf6y4:dDPxPTJAj9jK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 195KB
- SHA256 f733a8fb2725c70b54ff02dbce34164cfc88d4147c8bdb7dfde3132cde8e30be
- MD5 5f92fd94fe5a29a72f1b752aaec75338
- SHA1 4e54627b90e7a2111148869efd3ffa14ce5d79cf
- SHA512 003b1c7e8820c74aa397129032f95782e4b655dad94e3d5eb5442d73deca790450823a38b34be3ff195e1c5bd9cf0935702af645f44cee872f792161afd05b89
- SSDEEP 3072:6DWpDWYPxPTJe4cjWEjWqR/D5zf6ydyf+abMkF24kzK3jbrCkoRJNDNR/D5zf6yv:dDPxPTJAj9jvIjNDv0bNXkbvL0
- MD5 SHA1 SHA512 SSDEEP