Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 03:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
- Size 57KB
- Sample240602-d9v8kshg31
- SHA256 4dc64bce0efcdc3d30d8919b02f93b6c54edadc3959f4667ea1f0311946e1b04
- MD5 30a7e91e4ebce59ba2806a9922dfcef0
- SHA1 faf1f8e89cf2287278ef8944a010074e435881c0
- SHA512 322e05166f5d89e5cdc7dfdba1f1dab3ade715aa444c6186081401b9b0178abe41de08b05732b0b85220840bff022a98cf81e60a70ded32f6d8f3320281b82f7
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5n9c4cO:W7ZNLpApCZrt8PWGoPWGANdNb
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5251) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLPROXY.DLL.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.ServicePoint.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\ExitPush.docx.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL107.XML.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-BR.pak.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ppd.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\UIAutomationProvider.resources.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-pl.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-phn.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\ANALYS32.XLL.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationTypes.resources.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-180.png.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\30a7e91e4ebce59ba2806a9922dfcef0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4144
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3416,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:81⤵PID:4340
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
- Size 57KB
- SHA256 5f681c8c5331200dc480e0d64ebee234036b0b727c3a3713826cc324ee398f7d
- MD5 ef54e8d4c8544d64bf2fc70df1beaea5
- SHA1 9c25a85818cbab9a4cee8a4ad34af97bf7a31974
- SHA512 c0c8a05cf2572975361bf4aaeb5a349c23c6fb1a8d5ca2268030b65e3a2efe1990ecce1774c0d58060f93234e5c2967ea0a50e9625d0fc93cb040e2eca11c57b
- SSDEEP 768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsR5nd5n9c4cj:W7ZNLpApCZrt8PWGoPWGANdNe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 170KB
- SHA256 af610ab0a67ea564eccd2a4c3daf92638900af1e8c90ac8e9bc5ec63e0c512c8
- MD5 2409788883c1e205f26cf84d03118451
- SHA1 47901b05fb979f8895b91ae3a7102b0b5ca31633
- SHA512 99a423c15201683c04f13f984da59c1843b621a6cec1963cca835337e0c6a2bfe9d93004a9f5107cc637585c8ace08a4bbd39d8e46b5cfa50f540a47430a289b
- SSDEEP 3072:6NLWpCZIzDJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPl:u6NJ3a3LXGZkUcTb1JcrjQ4/
- MD5 SHA1 SHA512 SSDEEP