Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 14:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe
-
Size
46KB
-
MD5
18fa959d8c4d865adc563159d16f2e30
-
SHA1
867ebabf40ca90b4916978eed75c27b1325a7e58
-
SHA256
cdf2c97ef808e346b097c7229024af8532fc26f4c0e3aae8aec00645eacc2fa7
-
SHA512
d4bde6144fb638ef5d720a9ccf349272bff27352bac8bb7898474bad55c6ef377e5055b3553317b5266a8c9f0e8c18280fd219b7eed656dd8f6c7d7ce15e8122
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecD4:W7BlpNLpARFbhblkYlkuvIYFWcDYcD4
Score
9/10
Malware Config
Signatures
-
Renames multiple (5337) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationFramework.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ppd.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN075.XML.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-100.png.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\WindowsBase.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Aspect.xml.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationTypes.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\wordEtw.man.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODTXT.DLL.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\PresentationCore.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationUI.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+NewSQLServerConnection.odc.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOADFPS.DLL.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-100.png.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationFramework.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ppd.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\br.txt.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Forms.resources.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MINSBPROXY.DLL.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.stats.json.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 18fa959d8c4d865adc563159d16f2e30_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5520f922810173e9a09f9077fa54ffdfc
SHA1a24f340f384243e24c26d3318cc9b4ef1468a4aa
SHA256e1ea11506b8af9a2a8652134f35dfab7ea5cf9466f3789f56f01835c5a05e8ae
SHA512570427e5b86424581d408eb019c695b339796bf2cda4dbef061c63c588c43efb95874ec57874b3c4c232ce51d70e916941e80d74225d53c4aae8ee88c172a81a
-
Filesize
145KB
MD5a8698db4ffbe2cfffd44432fc3a790e6
SHA191b746b670532e2982039320cd5479aac16a7661
SHA2567c02fb990cc05d4894ae306ee4d29ccbdf9d9e29bff03115758451ac2136a4f6
SHA512c4ffa2b2a9676f85b572c7afbc08426b42f917cd4ae2bfb04f04ccd799d973b5f8f4491747873ee26ad3f467e1a743c1f4f9792e1e2e6a3ecd5c9978c6dae3ba