Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe
- Size 91KB
- Sample240602-aee2bsbg3w
- SHA256 5a853947a2c71ab7d61d473a9b1845d1f78c22f95e91447d0429cab37f8b96c2
- MD5 11053d966d7fabade59015fc53a299e0
- SHA1 860fbf5bc086068bcb84345df0953a5f130cbf34
- SHA512 b8a7c187f09e6ac020da01553bfe99a0d4a4b37c3a735067d5a64c00558e28d637fae4598c1b002f5f1cf8b46f07b7a119769d3b5282a41a6385d4fd57448932
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/c:6e7WpMaxeb0CYJ97lEYNR73e+eKZc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4853) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xalan.md.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-pl.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\msquic.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\libpng.md.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Input.Manipulations.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\WindowsBase.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.RuntimeInformation.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_profile_large.png.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\JAWTAccessBridge-64.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CERTINTL.DLL.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\BlockResolve.vssm.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp 11053d966d7fabade59015fc53a299e0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp
- Size 91KB
- SHA256 4c25cf31432fa16b0ff65f98a8ff326a512910c81072db4ade4439f06244e761
- MD5 95bcc287a079b8f10db53aea4b06cfe8
- SHA1 cbed76a7541f7a9c861c0168fb7d9b19fe231d1e
- SHA512 afe4e60ae7dfb2ca0382ba3040d62cc4ad81ff9255f5e9031b92a7823a71848ac0166ba7a691d9c19dc6a1ffaf7c3fac700b6deee72d48d22b6480f22c1a04e0
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/w:6e7WpMaxeb0CYJ97lEYNR73e+eKZw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 190KB
- SHA256 20d80881bad3b924c9d176fb8daa0f36f69b7cd9ff0d286bd2330d7fa28d2606
- MD5 2ae705f161534b312e0f25cf9608184a
- SHA1 fc2b3c9fe5f59fc5e21252d29ddd57eefa5bd322
- SHA512 b199d72049958f4c48a2d56c1915ebae18a82c930891a619ad1a33424b1799660b0368dc359949c361a383e98d99caf031a77c0b15bb7180a541d0cbda2bbe1e
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZaWHIjN3tj6qnv0b2UrXkbvL+:RqKvb0CYJ973e+eKZ9IjNDv0bNXkbvL+
- MD5 SHA1 SHA512 SSDEEP