4dc64bce0efcdc3d30d8919b02f93b6c54edadc3959f4667ea1f0311946e1b04

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
Size

57KB
MD5

30a7e91e4ebce59ba2806a9922dfcef0
SHA1

faf1f8e89cf2287278ef8944a010074e435881c0
SHA256

4dc64bce0efcdc3d30d8919b02f93b6c54edadc3959f4667ea1f0311946e1b04
SHA512

322e05166f5d89e5cdc7dfdba1f1dab3ade715aa444c6186081401b9b0178abe41de08b05732b0b85220840bff022a98cf81e60a70ded32f6d8f3320281b82f7
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5n9c4cO:W7ZNLpApCZrt8PWGoPWGANdNb

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5251) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\ExitPush.docx.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-BR.pak.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
1⤵
PID:4340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
57KB

MD5
ef54e8d4c8544d64bf2fc70df1beaea5

SHA1
9c25a85818cbab9a4cee8a4ad34af97bf7a31974

SHA256
5f681c8c5331200dc480e0d64ebee234036b0b727c3a3713826cc324ee398f7d

SHA512
c0c8a05cf2572975361bf4aaeb5a349c23c6fb1a8d5ca2268030b65e3a2efe1990ecce1774c0d58060f93234e5c2967ea0a50e9625d0fc93cb040e2eca11c57b

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
170KB

MD5
2409788883c1e205f26cf84d03118451

SHA1
47901b05fb979f8895b91ae3a7102b0b5ca31633

SHA256
af610ab0a67ea564eccd2a4c3daf92638900af1e8c90ac8e9bc5ec63e0c512c8

SHA512
99a423c15201683c04f13f984da59c1843b621a6cec1963cca835337e0c6a2bfe9d93004a9f5107cc637585c8ace08a4bbd39d8e46b5cfa50f540a47430a289b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads