1996bee7cbc45a3d82bebeb878b8407662fb0253b00a2be4a79bc0d826b552d9

Analysis

max time kernel
150s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
Size

95KB
MD5

072dabfa586171481f1af5bd1d22c440
SHA1

e64ec635d978a5a6171a18d6f8ac25ce26c238cc
SHA256

1996bee7cbc45a3d82bebeb878b8407662fb0253b00a2be4a79bc0d826b552d9
SHA512

594782ce6d00a0b35ae1670c638dd205f020681001974a15c6c6c08e48e02b8ee36c0eef2726a7d254b28692532652f7b297ba38101cd9280e485227547fbb64
SSDEEP

1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPN5Bc:6rWpcOPxPke+e3fFpsJOfFpsJbgEe

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\lib\classlist.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.HttpUtility.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Xaml.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-80.png.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\de.pak.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-math-l1-1-0.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsBase.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH.HXS.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\msipc.dll.mui.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 7.0.16 (x64).swidtag.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipTsf.dll.mui.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-convert-l1-1-0.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.Core.dll.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ppd.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tabskb.dll.mui.tmp	072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\072dabfa586171481f1af5bd1d22c440_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.tmp

Filesize
96KB

MD5
d7cea0db9096d855d13fc8ad36b695fd

SHA1
dd2976e46fbeb76a64b17863e8369d2e4dc23031

SHA256
d0adf5dff2649e48eba338fd199a884550157cd1a90a4b30d77778423d924db4

SHA512
89b1cddfd9e0411ce30a8187c54c5a416dfc017d0fbdd3bffdd1dd8735bfcbb05a869a3c0595811e330849c512293287a2730c75f6c34a9572b2264f8d158913

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
194KB

MD5
a4c573d64478b8ef1a668642c9ba04e1

SHA1
499b9f152644c834ad81eea09cedf5e6f66c6f91

SHA256
f3202fc15e31da27453d8271641a2b0a5860ac0f7ac0f03ccd1136b2c57b40f0

SHA512
5a13cbbb051da26ed2c58987d8cf3d805968d6bd1a8f63c98e1234b346c987851549a49523aca4b27108630cb7bf25f4c275af5195bb6c375014c414e75be420

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads