Analysis
- max time kernel
150s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe
- Size 79KB
- Sample240603-ranaksgg71
- SHA256 7ed2054c77cfb09dfb850aa4f62dc0e0ee5265902331ad4f95238ad6be4124bb
- MD5 a5ad8f268652b92041e30e69513ccd10
- SHA1 2d8dea02a026806e36c0a54555132f229036268e
- SHA512 869814f688cc51f8878d070933364293ffb58fe2b683f5fee7b9ac946bc9849db3f6902d4979d06867e6f6fefd20dd6bfccd9c6137f2b1ad4758d292aa199d50
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tUyCUyCU2q:6e7WpP9oVLQthbYY9oVLQthbUrt7t44s
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Controls.Ribbon.resources.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_fr.properties.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Wisp.thmx.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\gl.txt.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-phn.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado21.tlb.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.EditorRibbon.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_TW.properties.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoBeta.png.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-ul-oob.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ul-oob.xrm-ms.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp a5ad8f268652b92041e30e69513ccd10_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 79KB
- SHA256 9e2cf143204c7df2adf5f5ffc40ccd98f47eb05a76c1717b15dcaaa10d81215d
- MD5 bf466b0d6feab3acb53d0a7323373c90
- SHA1 067c4f05d86abb47ce193b18fa60dd79810119f7
- SHA512 04a5af0d3ed4bdb919e48fadc2f4cbbc81c929fbc690143543acb22a7f0fd5ec93a55e02776b67a0892fa08f0dbea102182c60ec2b70cc9312877e1ea4576c7e
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tUyCUyCU2X:6e7WpP9oVLQthbYY9oVLQthbUrt7t44l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 178KB
- SHA256 a8a117e521cfd6c778e9e7dfaaaa948e5a707b9c018cecce87122c674462a0cd
- MD5 57559124b1a6613a9071dda7ac9c14a2
- SHA1 6d384d4b3098217f77744854b1281d9c518d52aa
- SHA512 4d31261ef9e4c0403ae3a1864c2f74ea532f84f5620501b43a249677bc123be17a0c030f2a90a28706070fd8a3010ba2fe2616cb05fbeaf4a47f23d8a80ede05
- SSDEEP 3072:6e7WpP9oVLQthbYY9oVLQthbUrt7t44U2qWHIjN3tj6qnv0b2UrXkbvL9:RqAK2NIjNDv0bNXkbvL9
- MD5 SHA1 SHA512 SSDEEP