Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03-06-2024 12:56

General

  • Target

    a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe

  • Size

    46KB

  • MD5

    a42c8706e8553d5325a74c0f14d07640

  • SHA1

    eed0e3482967f689960a33e841c67ac3494be85c

  • SHA256

    a90a763b30b7ee319f7ec8448b23ef09fd97b303cb6cd49a28d966dde4c0ac59

  • SHA512

    6a064c9bdd735485cdd2981335ef87c1ba8d924c22b2e94b9d62efb2eb105c95defddd1cd0751417568b9a256d69b0995ff5b541782432d544bd8889c0bee4f3

  • SSDEEP

    768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1Mse:W7ZNLpApCZrt8PWGoPWGZ

Score
9/10

Malware Config

Signatures

  • Renames multiple (1249) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    e70f2b29a5e95994e7227ce264b867f2

    SHA1

    798b3621eb52be90c3c91e12101fc2d92110d762

    SHA256

    6bde154952c2c9fa1c4144d3915428e7031953c8711e8b52763702e32fff9c76

    SHA512

    8df12c1532023ae6cdedd7e0143995a470159b7c8472bd34262ad01847a138001078eebd5e31b2a1a3117cc82849345ea924e8e74360701f32fa35adb5ae04d6

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    55KB

    MD5

    3d93f3fedad279a8d14b2c4a85615333

    SHA1

    57ac4139328f877211c94f5792b1a6eee424c5ae

    SHA256

    05c3e890d43f056c838f0391675bfa3c7bffa61f0363f402c211ccf4f1e21951

    SHA512

    082e34f801f4e18d461aa9855ba8a7d26dd9448df86f9bb198f9cdb4d5a7a3fc9817c7ceb31cec3a29bb9c489dde62d571ca5732354112d7b2131ee2e4371bf9