Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 03:15
Static task
static1
Behavioral task
behavioral1
Sample
86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe
-
Size
87KB
-
MD5
86ee3b412ee037a8a76389a9d14ae110
-
SHA1
9f14c2ec41c162188606c5bb100089834871fb5f
-
SHA256
811179c24541b0ce13bf2c1e3fd13c361b318b6b35bdf24ff35a8722291f74ea
-
SHA512
145588f12a09bb732e6cdb8f96c2ff8d1868724c629ceda113978d6770937f6424945431aff6d9f82e64cd5d37a40f623390241931e54faccdb9ffdb94883ce6
-
SSDEEP
1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8j:6DWpwE7oL2e+efZwZ08i8j
Malware Config
Signatures
-
Renames multiple (1719) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msadomd.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tt.txt.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TabTip.exe.mui.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\IEShims.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\w2k_lsa_auth.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy.jar.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Threading.Tasks.Dataflow.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\nacl_irt_x86_64.nexe.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javafx_iio.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\eo.txt.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.ResourceManager.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\hostpolicy.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\UIAutomationTypes.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\PresentationFramework.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\7-Zip\readme.txt.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-util-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\System.Windows.Forms.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.FileVersionInfo.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tg.txt.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\ReachFramework.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.NetworkInformation.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Claims.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\System.Xaml.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Dynamic.Runtime.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-handle-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\PresentationCore.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Windows.Extensions.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Printing.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\ucrtbase.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp 86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86ee3b412ee037a8a76389a9d14ae110_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:1848
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:3204
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5741ec6f2de986f9b40fa633503d1ee9b
SHA1ae1111d1477ce1a1074ca2cc1a115497d1ec1e72
SHA256b052789f06f5e8712c5dd2052106c10aaffd43415396bc836713a5ca2e50a52c
SHA512b79e9d4e1473c3b2b60264298b9f9da2c842b1f8246b7192fb77287bfc4039075479ac55cab2c4dbf8793fbb8f4565f0af1741550a21736c7072d3f4ff0fd394
-
Filesize
87KB
MD5c92b87088c20803ddb50280581d99533
SHA1661c5f89e4e945a254560627c65f35fc131d90b5
SHA2563ce1a8af3fee1f2ee6a6dda48a533968e288851a334d422f3879b4583c1025d7
SHA5127b878f7b76ebaca875c54f7cb9a8ab549bd0b941de42dcc112045f13266ede3c57199caec9eb3ed9a72c714daf8c4118620f1ea603351101b9a3dcf4869cff5e