Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/06/2024, 03:15

General

  • Target

    86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe

  • Size

    87KB

  • MD5

    86ee3b412ee037a8a76389a9d14ae110

  • SHA1

    9f14c2ec41c162188606c5bb100089834871fb5f

  • SHA256

    811179c24541b0ce13bf2c1e3fd13c361b318b6b35bdf24ff35a8722291f74ea

  • SHA512

    145588f12a09bb732e6cdb8f96c2ff8d1868724c629ceda113978d6770937f6424945431aff6d9f82e64cd5d37a40f623390241931e54faccdb9ffdb94883ce6

  • SSDEEP

    1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8j:6DWpwE7oL2e+efZwZ08i8j

Score
9/10

Malware Config

Signatures

  • Renames multiple (1719) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1848
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3204

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp

            Filesize

            88KB

            MD5

            741ec6f2de986f9b40fa633503d1ee9b

            SHA1

            ae1111d1477ce1a1074ca2cc1a115497d1ec1e72

            SHA256

            b052789f06f5e8712c5dd2052106c10aaffd43415396bc836713a5ca2e50a52c

            SHA512

            b79e9d4e1473c3b2b60264298b9f9da2c842b1f8246b7192fb77287bfc4039075479ac55cab2c4dbf8793fbb8f4565f0af1741550a21736c7072d3f4ff0fd394

          • C:\libsmartscreen.dll.tmp

            Filesize

            87KB

            MD5

            c92b87088c20803ddb50280581d99533

            SHA1

            661c5f89e4e945a254560627c65f35fc131d90b5

            SHA256

            3ce1a8af3fee1f2ee6a6dda48a533968e288851a334d422f3879b4583c1025d7

            SHA512

            7b878f7b76ebaca875c54f7cb9a8ab549bd0b941de42dcc112045f13266ede3c57199caec9eb3ed9a72c714daf8c4118620f1ea603351101b9a3dcf4869cff5e