Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 05:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe
-
Size
81KB
-
MD5
3ceba9119b8aee5ad311a7f85a754580
-
SHA1
f2a2d05fe741d354f25bfc950b289292786c1012
-
SHA256
b3d93d56de1e560980741059ab6ee9a3c375d3db7209943519563b2f439381d1
-
SHA512
65d059a2131bfe14feff74ef48be0263e567b093cd2f9b89bdaf70b7df2eee0f55227e46e1801de9246635b308c37b8ee1d353e603e8b8616a23934aba0bf595
-
SSDEEP
1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tUyCUyCd:6e7WpP9oVLQthbYY9oVLQthbUrt7t44d
Score
9/10
Malware Config
Signatures
-
Renames multiple (5119) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-pl.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\bn.pak.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-140.png.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Grace-ul-oob.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial3-pl.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-pl.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000C.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7zCon.sfx.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Luna.dll.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office-client15.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp 3ceba9119b8aee5ad311a7f85a754580_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5e2646647126957d7aa1403b7a467409d
SHA1942ef1aa5cb24ee860789acee78492e542893ace
SHA256651ffad259e5929f2a3cbf338fd6100e590377afbc17e15f86a81eaf928a3c86
SHA5120cb4c5a8877a67cd985b737fc8c802709af2e3ed7f2ab688ec52103998c5394b20210a4b8c2f8e9349d7581d143a8fdf6b788008494bba5bae270d48e773c9ee
-
Filesize
180KB
MD51719f7f205e0a8a9deff2e7362c87b01
SHA1db511cfa25b15474a0529507feb734c2a563e78c
SHA25645374267caea7ccb6c41f1c88f071a6a1d6af9babe6ac9982acd9e920bd01cbf
SHA512258031d369784f1cc21c88ef0dc79d75a6ee118105a83ccfe082c3cd3a1fc480cb38dbe237a320c9a6f809f8c9f1cce18a953ec050906c506f2865ec8f3dac44