f27db296cb77bf592024bd0c2c7a8d405d86d90cacb63510d1a25a3b670acef9

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 09:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
Size

51KB
MD5

49f071820727c04af124479e25a302a0
SHA1

15475cf0518513235a134e3771baa1a4e411c367
SHA256

f27db296cb77bf592024bd0c2c7a8d405d86d90cacb63510d1a25a3b670acef9
SHA512

b0cd9ca781f6db51a657da6824d992b0c8c55bca44d45056086920ed4a355fddc11160330a185a2eb188ae680ca2185c8aa14ab8220bd9c5bcf0fbd0b91e4413
SSDEEP

768:W7BlpNLpARFbhblkYlkrt8PWGoPWGqMs1MsC:W7ZNLpApCZrt8PWGoPWG1

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2065) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\desktop.ini.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Primitives.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Transactions.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\WindowsFormsIntegration.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\WindowsFormsIntegration.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebHeaderCollection.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\InvokeLock.easmx.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\netstandard.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Windows.Forms.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\System.Xaml.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationNative_cor3.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\msinfo32.exe.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.VisualBasic.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Console.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Handles.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlDocument.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\PresentationFramework.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\EnableRepair.odt.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsFormsIntegration.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ReachFramework.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uk.txt.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Collections.Specialized.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.ServicePoint.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\PresentationFramework.resources.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-locale-l1-1-0.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.SecureString.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2gss.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\content-types.properties.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	49f071820727c04af124479e25a302a0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\49f071820727c04af124479e25a302a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\49f071820727c04af124479e25a302a0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:4864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

Filesize
51KB

MD5
8726662521d00f7cfc9461969401e1e3

SHA1
6736fbdbb4075528aced89ce117d44377cd4a055

SHA256
bb3f75751994d29a183866e94fdc5a962fbae006e8fd6944f3f9ab9a7e7fc478

SHA512
92b7510d64ef351a89ae583b57ce2372738cfe65ca54bcb27c6d16c5dc1bca0fb769d7fd4d1e2f083c0cdfee79800d30be9122765f9eabf4fcda55dcef5b6d80

Download Submit
C:\libsmartscreen.dll.tmp

Filesize
51KB

MD5
12b283b14d43b6dec43a534c570e91fc

SHA1
16b103fc51d9f65dc01822300e399a3b6c25b8b4

SHA256
e5dd4e98a26045a603a0fe691b37ea77a357df12a43fae539431dd26ff39cf30

SHA512
f775bc3f184bca9c232ee34545854ae1941849673850963a9ebd9a3fbdaf228f9e54477785554bbd4ce13e1b69c82d166ed6f2c447a726c86b2373f7d8366f35

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads