Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 23:05

General

  • Target

    1e92ca64438e03f9759ca3485af4b3b0_NeikiAnalytics.exe

  • Size

    42KB

  • MD5

    1e92ca64438e03f9759ca3485af4b3b0

  • SHA1

    7b856c885b0c6f38700dec8d67a9a9adc211d2ce

  • SHA256

    396e40f8c606daa31d2c18880f26c8e2d9b6232941f9fc2f5690929a7350f868

  • SHA512

    52dfc9169fb8e36176aa24f2dbec824493f108eac4ae1065495188e1a397bc96c855a8cb41aaa7bfc2d8793d5d04ad47d402a43b00824d14ac60a1e1d56ec0a7

  • SSDEEP

    384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxAa2aB:W7BlpppARFbhWJmAa2aB

Score
9/10

Malware Config

Signatures

  • Renames multiple (5243) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e92ca64438e03f9759ca3485af4b3b0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\1e92ca64438e03f9759ca3485af4b3b0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp

    Filesize

    42KB

    MD5

    9694ca02edcf220eef5089c4b8a11b07

    SHA1

    1aa087379b372b8a1159fd9b460368826d538c81

    SHA256

    58dd690349e2382397e8ff4cc4490da07264995479c4850bafa4564722a64b37

    SHA512

    b78059ef602b7ab2ee0344b5d1d2ba5f6428b17f06eb44ba176cd0c562b0d3a3d862a19407e97b3cdbf90225103b53d11ecca34932c76e3d97238c2b2bc74a78

  • C:\Program Files\7-Zip\7-zip.dll.tmp

    Filesize

    141KB

    MD5

    7ed3451ed8f5ebe84e5b96194e8faa8a

    SHA1

    2b836220afabc897da52e8a5f78c50e181e46321

    SHA256

    c680ab0c84d1c72b6a4f37000fa15368a5b63253df2022c57716aded9da12877

    SHA512

    00827381405482debcaf0950259e4a48a9cce54cd9ed28dd4d7998247ed340c0866048aed4801ea43bf7be94d420336a6bfdcc9476637c43b39e5ee8adbc67ad