Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 00:05

General

  • Target

    2021d29e64c53d9daca87df8ce71d9e0_NeikiAnalytics.exe

  • Size

    74KB

  • MD5

    2021d29e64c53d9daca87df8ce71d9e0

  • SHA1

    80dcef20b1a8d39647a4ddf96cde7d040cc7b876

  • SHA256

    d3bab3c59656f139de8430700d29bc64b1cd2ffd3addd7fa76d3a84743eb1835

  • SHA512

    e573b184bb93a59a60ed7da20dadbbf66b23684400be028569c9d7d8b2ece233dbbf7062d613bc8ed89aa017a28abf57e0cf88d573d004c6f859a6a78c68984f

  • SSDEEP

    1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7t5m0m69M:6e7WpP9oVLQthbYY9oVLQthbUrt7t5mh

Score
9/10

Malware Config

Signatures

  • Renames multiple (3611) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2021d29e64c53d9daca87df8ce71d9e0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2021d29e64c53d9daca87df8ce71d9e0_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

    Filesize

    75KB

    MD5

    3c24a0c06c1d96d8955ca3ff3fc9bc24

    SHA1

    2eca06eb25bd7549c06dd0c32725311f22ff70ae

    SHA256

    58d3c5caeb59845223b6b0a2e0d094f002c3c2b1b5d9148eca02a33d4fdb9207

    SHA512

    5e34e567cc9108b8034af94fc58d114ae5c032af443ecc2c5eb1881941a5f980302d8bed526237c0b780bf5d7f477da26e2a3548b87232e0c09c7a4b678800ee

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    84KB

    MD5

    88467720472be8c5016d3f08a857a2dc

    SHA1

    201231dade282a4ff5d767ffe1631baf259eb62b

    SHA256

    4d38df6912e7a2dcdaeb63972aa820e026cf3ccdb9c68ea7ac11ce05e48eac82

    SHA512

    ae328003f0951cd43e056bdcf3571937afb34801086c62b313d8a9d24eb2e9c1751dabaab1b8feb1c61b8ca43b06073b7811e89d16890e1ed92899e0a309c5fc