Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 12:56

General

  • Target

    a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe

  • Size

    46KB

  • MD5

    a42c8706e8553d5325a74c0f14d07640

  • SHA1

    eed0e3482967f689960a33e841c67ac3494be85c

  • SHA256

    a90a763b30b7ee319f7ec8448b23ef09fd97b303cb6cd49a28d966dde4c0ac59

  • SHA512

    6a064c9bdd735485cdd2981335ef87c1ba8d924c22b2e94b9d62efb2eb105c95defddd1cd0751417568b9a256d69b0995ff5b541782432d544bd8889c0bee4f3

  • SSDEEP

    768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1Mse:W7ZNLpApCZrt8PWGoPWGZ

Score
9/10

Malware Config

Signatures

  • Renames multiple (5204) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a42c8706e8553d5325a74c0f14d07640_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4018855536-2201274732-320770143-1000\desktop.ini.tmp

    Filesize

    46KB

    MD5

    a1ac6e601bbefc533b1b09d51103135e

    SHA1

    136804f5e2b61f73b5ac983673fb550a2ce754e7

    SHA256

    34d6dd4ddf9306ad0cf4738c54045102dcd5ae80dfc08506dda2c92970e1877e

    SHA512

    a6369025790b206e085b2cd04fa436cbe565de5e1846e05b7d6001a19bcb0fd8ee77656902266bcc4ac5d47a25e414e43b6f58da240aedc1dec12215a555f7ee

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    145KB

    MD5

    c8714013b3f4bea5876561c1185d3c74

    SHA1

    edb6280c4a2f97d7b507857a92e23d9eb6d57c0b

    SHA256

    a3d4204a2aa12ab39a9f73a2b7534c9e6387b4040fe65fb0488cefeb960b80a1

    SHA512

    8d2ed9df5664273529ab921b52dc566f06e1779ab45afef4930b3889fe4426c3445f939357273c5c2c7f73f8434c26d3a42f9c16c67c62f02a5a2f7451458d3f