Analysis
-
max time kernel
149s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe
-
Size
66KB
-
MD5
7ffe025947477656b2fd33dfe1187990
-
SHA1
a4061e92ecb197d9cc681359a5669bd5ae1fb80c
-
SHA256
3fd01ecebff2f55154afd3feb09a52521fa8caf9483296a1f909545869fb0bd8
-
SHA512
a4b30b1181d24742681bf3cf131efa91b5f517c1fc3ab3edd87d57f3d889b42a19cf3aba2d5a40a9caed23baf54025437355c0a79b8c306d8622f8521a6080a6
-
SSDEEP
1536:W7ZhA7pApvOsOKjC0YSilpFpfkJOMWpiapil:6e7WpXYvnximil
Malware Config
Signatures
-
Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dcpr.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.EventLog.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ul-oob.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\PresentationFramework.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationCore.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ExtExport.exe.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\server\jvm.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ul-oob.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-process-l1-1-0.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ppd.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InkObj.dll.mui.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Xaml.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Interop.MSDASC.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.DLL.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Pipes.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\BCSRuntimeRes.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL105.XML.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 7ffe025947477656b2fd33dfe1187990_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
66KB
MD5a765356b720536eb7742caed40147112
SHA1c0bf9791d059321bc6f4a5d7fbc6ae58aeb3affc
SHA256ad2ab28d202f6f9c2aab4748d3173ce27f294867a42c205808f55af666fdfc38
SHA512a74db284769e39b9538c224623725365bbd59480b960fcf1276f2a63e03f4df1ceef537c45c3d97ba616e03c4d6da5e5496081e6e3ed1e7085400869d8776aaa
-
Filesize
165KB
MD59598a2834332b5638f1df8e96817c21e
SHA1d793f2ab6772be85a529d75d8d0a696855f2892b
SHA256b538678e524fd0dadbc12dde7a872a4c932bf99d14f56ebbbe5f1561059fc55e
SHA512727c1f686cd450aac18bc8a7b7c42afeee476f61309fd9adb7f478af63834ebf891fe028c23f6275dd8cd4992cbff7b9880ea461852553064858cbfd835f18a9