Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 00:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe
- Size 84KB
- Sample240611-bb663sxfle
- SHA256 ff2fea36cc8275a835a7c43d663aeb3a00b032776cb361fc6350b347ba80f600
- MD5 21e3ce5681879abe3ecec9b8f42f4080
- SHA1 7bb04344dae2f434098109ec38ce92038c181ad5
- SHA512 dda6d8bd3426d4f569f719a890c2edfedfecf92ffe4c5a6887316a58cd88957b0d986ed2e9896fff6d3bcd590460175a6c715b22e194694306119b426df4584b
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8/Re:6DWpwE7oL2e+efZwZ08i8s
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Handles.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.Design.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-ul-oob.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ne.txt.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-ul-phn.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Forms.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationTypes.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-ppd.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSTYLE.DLL.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\vcruntime140.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe.tmp 21e3ce5681879abe3ecec9b8f42f4080_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3571316656-3665257725-2415531812-1000\desktop.ini.tmp
- Size 85KB
- SHA256 ddcbabe2158df1875eb23cdd582c45d32c85cb85763ada4adaf32de430686c16
- MD5 b583563be236d87619824dfce3d992c1
- SHA1 5f422d9c4bc45810213c4cf90dd52f7056b99c02
- SHA512 c6ed034ed73ff05b053867b7545991ef91c99b43e9a4efa888ddc1781cf21fd9b05d7cee1316198f6bfd3dd9e56ddbd1dd6dd73bd033d20293c50eca17548ac4
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8/R0:6DWpwE7oL2e+efZwZ08i8i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 183KB
- SHA256 bc971f98355182235e1db34d343cd0b51164191b95537ff2567b159b801f189f
- MD5 c65d9cd78a36045a98b53e3e10d80fec
- SHA1 3bb5eab41d4e0ff6e24f91a7ad275590af97cdfe
- SHA512 7aa552388bb56ce9d6cfbc1e9d364eb2c10dd90c5126a34cf7276f49e1e7e5a125f3f64147dac8f84d7c708a6668b98d144ca5fa93fcbac2b8cd52c4262102b8
- SSDEEP 3072:6DWpwE7oL2e+efZwZ08i8AWHIjN3tj6qnv0b2UrXkbvLq:dN/e+efimJ4IjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP