Analysis

  • max time kernel
    149s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 04:49

General

  • Target

    8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe

  • Size

    45KB

  • MD5

    8d214a7b06ee01e32323bd076aa72cb0

  • SHA1

    70294a00386af3a6d10f341ba91117b2e4c91945

  • SHA256

    65014a87a5afd29fc8e2a175dfb9dda9375ecbb7eee6eb55e32b20518f55127b

  • SHA512

    6e78c01c923422a3642446786af8ef465a83ba7c02293f967f3fc13e00e78af4cf87448f1ec5f08e6fbade6f267abc9b71a3900ab1455916fcba48291e40dbfc

  • SSDEEP

    384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKriCZbQmJKUCZbQmJKV:W7BlpppARFbhWJoQmJKbQmJKV

Score
9/10

Malware Config

Signatures

  • Renames multiple (3734) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8d214a7b06ee01e32323bd076aa72cb0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2880

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-3452737119-3959686427-228443150-1000\desktop.ini.tmp

          Filesize

          45KB

          MD5

          b70a83ac79e7feb56962671a5349fc89

          SHA1

          de63f14d089cc584dbe25b9771b0d89dd0a8fa01

          SHA256

          948fdf564e70ac8f620fa860ec749aad9ce8047a1c3050ca76d9e10b7ae1bbb8

          SHA512

          962844460ba0d8494354ae3717e898a7364bbe537a8a7692d713e1ec5413044a2811da28f56895f06a56335df038c8573d15b9b95a164a7975b14d1bfef1cfa9

        • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

          Filesize

          54KB

          MD5

          157a429333cb4446e4879318d382e1af

          SHA1

          ecd5f2ede7f0ce8ac9a9a70d0924ac01c12998ef

          SHA256

          7d9d4d64aba2efd61ea70057ad37bc63e043be8a5f4c54ce87658d02f4ff859d

          SHA512

          e4215186913ea2ca82fb1d5b0f3b49e3208e0d9453fe25f873f556b89ec06beb1aafa26747b6068c180c1040e1b3588720869b24ad125ed0b4d57c040d76c26a