Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe
- Size 93KB
- Sample240603-ql7mxshb79
- SHA256 cfbad772c6ddb5066794fe6c9c843fea8f347e3526c8fcad76f5e29d7f25f21c
- MD5 a4cc5983f79b835d39feb76e854d9d00
- SHA1 eef845fcb4d28c04146bceab816fff1ac83bf237
- SHA512 f100b44e34516746fcdcaafcdc9ad734c8852bffc8fbc62440eafd5485af4f218f573c33b86db89b09589bf06eec87db20b17056f9f114d2f47c9291ceefb27d
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Cl/NdNo:6e7WpMaxeb0CYJ97lEYNR73e+eKZOzS
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4735) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Native.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\MSIPCEvents.man.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\net.properties.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019DemoR_BypassTrial180-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Claims.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-pl.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ReachFramework.resources.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Configuration.ConfigurationManager.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.ProtectedData.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\linessimple.dotx.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.TypeExtensions.dll.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ul-oob.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp a4cc5983f79b835d39feb76e854d9d00_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 93KB
- SHA256 5f649188a3b35ad7cec9524043c88140839a00ff908bd2daaec66561ddbe3801
- MD5 c61dbcd5e89b804d25dd9ed4db128db5
- SHA1 0d5e8eb7d91f2723e35251d743bdd2b8f313e139
- SHA512 cf5002b18e1e2e1f6b904c8754192672c1b47bd4073cdedd338acefddd650941c4d002faddcbca1b1692611b383bc2956861935526608fdadeec839537b23d11
- SSDEEP 1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/Cl/NdNB:6e7WpMaxeb0CYJ97lEYNR73e+eKZOzb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 192KB
- SHA256 06d890eef034dc545a2457a63aa32f765497df3ad238f15827ee43b95b814b49
- MD5 c72d46d2d0b8638af727fd26f971b678
- SHA1 3cce081325094e5aac4a1e7ed0ddabd29cd083db
- SHA512 cf2c80987248deb3d7a76836cf0a767e76874987fcb094a08d8ccc13d52c2cfb895b873736d00fb57f64868ad1291abe91974e49650b10188c172aa99a32bc30
- SSDEEP 3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOztWHIjN3tj6qnv0b2UrXkbvLd:RqKvb0CYJ973e+eKZ3IjNDv0bNXkbvLd
- MD5 SHA1 SHA512 SSDEEP