51d5480c86669eb0739e56889debd6927f013910928ad8db0f90e8043fe45238

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
Size

69KB
MD5

4c482c0e8db82dd2be9b2ec539d45540
SHA1

e1a0334e2fa654a91cc9a36dd2ee022ccfc75b56
SHA256

51d5480c86669eb0739e56889debd6927f013910928ad8db0f90e8043fe45238
SHA512

dbe32568717737bfa8840617d9433e78397f129ae4906de284fc9818caf4e531b3ccff08dd8334e3873bae264a5966e9e5157be3fc9ed331e04d441304d9270e
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhe:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsf

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5242) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-100.png.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoCanary.png.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Smokey Glass.eftx.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Loader.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdClient.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Design.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Xaml.resources.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\gu.pak.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ppd.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp	4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4c482c0e8db82dd2be9b2ec539d45540_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4488,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:8
1⤵
PID:752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
69KB

MD5
ce3cfdfad4f8ff90d0d756fa6244c851

SHA1
080e378882072e1ed80e1e7799ecf01960cfd5b6

SHA256
c53d4b965c7b5098d3d21d2322656470d73cfcc3452da98942a1fc5181a7f2e1

SHA512
920991a4f44b02dc046093665301308387caf18a29d48e8d4950de376063578de3905f44188fb3cedc17b1d9f50045715dd2765b37d1d82b9ed31648f0decf25

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
181KB

MD5
3caa599556c770ec7795b53cff2316f4

SHA1
bc0395eecd786dde5c0fb033dcf06e7e0c7dcf5d

SHA256
7fadea15eccbf0dcb5e60ca3a58a5676a36d12202691dcc8a19e4a9c6e853f49

SHA512
53c17c85f7c0da885bb7f02879667cd887f3fea1c2c8844961b98540ac73542fec53efd87e75e33b7b249c78945eaa81f2f25b16cdb35dcf163c5c58e94ca103

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads