Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10-06-2024 23:42
Static task
static1
Behavioral task
behavioral1
Sample
1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe
-
Size
73KB
-
MD5
1f7d83dc2d57d6722080cff5bb9f87d0
-
SHA1
3f79ef7ade62ddcdd7a58352b3d773359157ef4f
-
SHA256
851b14dc3fd547dc22eca8d7aea17485e3decb6965d33c7a6978010eb921ba09
-
SHA512
ad0b363698eafeb4901bd0b492b7c9d1df3b41c671a4b233f1c899a2676f26a82952849a3fe87a02e735f6917123f45fbb621d79e6efa413daba88812de2b5ac
-
SSDEEP
1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76G:6e7WpP9oVLQthbYY9oVLQthbUvb
Malware Config
Signatures
-
Renames multiple (5196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationTypes.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Exchange.WebServices.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsFormsIntegration.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebHeaderCollection.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xmlresolver.md.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\instrument.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsBase.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ppd.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\SLINTL.DLL.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Asn1.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-80.png.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\Office.Runtime.js.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationTypes.resources.dll.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MISTRAL.TTF.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe File created C:\Program Files\desktop.ini.tmp 1f7d83dc2d57d6722080cff5bb9f87d0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5df77cfd5e1ede15c3fee077c09e6af0c
SHA1b3bfddb9c418993f7f337f8e97cfa089d801d6a6
SHA256dab9800dea399c040f09a86bac7272f55ed034252b13bbf5718a40a793e54e0c
SHA512967229704dada16ea9d85b5f3c11ab12a7b4f53aea98b5f2789e2e8a2c9bdaadc3aea8b558f566cf0b774dfbd08395e1a4d73f3c8d843cdf20cc97fc6f4fef83
-
Filesize
172KB
MD58d0746656759def2d44967b31b5a3bfd
SHA1a0e19b545bc6ce58a3f3bb3aff25b614330f08bc
SHA2565535b5c0e386dcee6ccce9193e1a50f0240bd1b0e081aab408277c0c7bff5032
SHA5122216a3b1c5ac0d7da28910dd49dc5e8dfbfa44feebbf513ce1d5862184b3581e633de43c05d649cec5673f7d5fdd3a7b7bb223db57a1a65fd3fe317c44efa204