Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 03:01
Behavioral task
behavioral1
Sample
2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe
-
Size
240KB
-
MD5
2508cdafe17535d5a7d8bca1d1eefdd0
-
SHA1
67ea2b730e2133119a9d1f54c94dcbec3fd20e2a
-
SHA256
bc705525039579bb1bef77207c4e1578718a94014d5c36bea8a46170b3c5fd2d
-
SHA512
92988900906e87c36d529141b1d2a1711c1fa382432e90d3f793d1815f9e7df0a3ff4e47226ef3e01593138c0f64cd1f4dd4fa5999ed9b9a746a3acdab00c2d1
-
SSDEEP
3072:fnymCAIuZAIuYSMjoqtMHfhfAfAIuZAIuYSMjoqtMHfhfm:KmCAIuZAIuDMVtM/GfAIuZAIuDMVtM/w
Malware Config
Signatures
-
Renames multiple (4622) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1304-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002327d-2.dat upx behavioral2/files/0x000800000002294e-6.dat upx behavioral2/memory/1304-1500-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.Tools.Applications.Runtime.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Primitives.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\meta-index.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Office.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nb.pak.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsFormsIntegration.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\mr.pak.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\VVIEWRES.DLL.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Accessibility.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Design.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Layout.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ppd.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ul-oob.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Printing.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Xaml.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\eventlog_provider.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bg.pak.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Expressions.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Primitives.resources.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp 2508cdafe17535d5a7d8bca1d1eefdd0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD59a1048f61f131da35394adebb7150b96
SHA15d081c1de088f95e97ec725ab7697a003b3de5d4
SHA256454d18875b50a3c910a7edec031ecbfc98a33bb4ed4aba3285fa7a6d35e63b65
SHA51295c2198bba8338df03f505f483448571cf797ba08e3b60749f3ce8f3ea41ef31a23fcdf88113f3afb9f3de77ada936708c24f06a04c5325d8c0b29ba02cb1b1f
-
Filesize
339KB
MD5eca1cf5d6473eb28277b43f90ef8acbd
SHA1723d1a681f5754405769acb29fa96fdeed0eface
SHA256a1274a6690a11b31a80ded89077650431adff7292bb1bab7f203d4d15f826924
SHA5120178dd1417d3b407034f0468166dd81c020e3591fe011c77788016a0bfae34eb3aa71c89d6fea5248cc62fa706e8abb37564b55f2639198c2f6ad67343edd941