Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 00:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe
- Size 58KB
- Sample240602-ajabmsce73
- SHA256 a93048c62da5d6c7a7598b2736b238a95000fa22d447d85942a95a621dae142e
- MD5 11e0105e77b73a09110f9ea951f030d0
- SHA1 4e106ef43d9edad93edad26c4372d6742b834ad5
- SHA512 577e43c1954120eba242d0b7e4668ee439cc29e6a27a99969991546ec86e68b0614adf335477add32fa9933971a291baf7784a8f7a7a95fea3f4cd907edbd988
- SSDEEP 768:W7BlphA7pARFbhvOsTKnKqtSpFCpF0YSiJgUpFpgFi101tlktRN8kgXZOXcvlktV:W7ZhA7pApvOsOKjC0YSilpFpfkJOMA
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4852) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-pl.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Memory.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-180.png.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\msipc.dll.mui.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ppd.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jcup.md.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WHOOSH.WAV.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\ReachFramework.resources.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.SPClient.Interfaces.DLL.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Mail.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-pl.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_de.properties.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\awt.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Xaml.resources.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\jfr\default.jfc.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Native.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Controls.Ribbon.resources.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp 11e0105e77b73a09110f9ea951f030d0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.tmp
- Size 58KB
- SHA256 4d2e5e1b68b8a8f5227382543c2eafc2d2d3eb80dcdeaef49cae29e8b419959c
- MD5 34ba07e219d5af12741d3239e126d008
- SHA1 6ff00ed719774a3c8db183cd00b373279c8a9b2c
- SHA512 fd2a9f0ca8ddaa57b3753d01006e151c71455331fec90c85b6a9f15328cfb6f6a4ecb22ac42396380684ec45c96f4e05457406304dc7fbf2a2ef3598589263fe
- SSDEEP 768:W7BlphA7pARFbhvOsTKnKqtSpFCpF0YSiJgUpFpgFi101tlktRN8kgXZOXcvlkth:W7ZhA7pApvOsOKjC0YSilpFpfkJOME
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 157KB
- SHA256 fc6af0760bc6d3a46648dd5d466f300c786761caf06cafcdbc5138dd65e66426
- MD5 568d879ac03398725d902b8ab51c6cf8
- SHA1 39f5dd8cc6e1e68fbef7884b57259611f6f660ed
- SHA512 e7d5ed9f27193b3648bcbc0ec39c1a4b2e719abeb77ba088ce3789f754e9bc8a7826922205217bc2beeb0485d25189616de18b19621ff1b20d9871b6db9be55a
- SSDEEP 3072:6e7WpXYvnkWHIjN3tj6qnv0b2UrXkbvLJ:RqRSHIjNDv0bNXkbvLJ
- MD5 SHA1 SHA512 SSDEEP