Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
263697af39060c4405002a65ea887130_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
263697af39060c4405002a65ea887130_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 263697af39060c4405002a65ea887130_NeikiAnalytics.exe
- Size 91KB
- Sample240611-d4mn9asflg
- SHA256 ffe7d85ca1d32ada459478c6e12145c181e4e189f6cf83c14c681adc2b5335a6
- MD5 263697af39060c4405002a65ea887130
- SHA1 146d19382d980d72ed52eb4d796d2e061ee0968e
- SHA512 ef8961d071d7ba139e5664904a5c53da06039209527d7b2b213aa1f8a6199dde4c4a53908c81e8f27f600ba540569053c1c3a38a4bc34019c6b45129125e506b
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPND:6rWpcOPxPke+e3fFpsJOfFpsJbgEV
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\NL7MODELS000A.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.Local.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationProvider.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\packager.jar.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_FR.LEX.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SFBAPPSDK.DLL.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteFilter.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-pl.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Forms.Primitives.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\af.pak.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ppd.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTrial-ppd.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsBase.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 263697af39060c4405002a65ea887130_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
- Size 92KB
- SHA256 cf05856fcc59536848933e3c79174165becc11b46d545be850babe7210436769
- MD5 9cc97430e84063711402ed032143c850
- SHA1 6ce310b93551f549667a4abd59c842bb455cbeb2
- SHA512 da2595dbe24ce14ac48e9e6a5958e0914d83574f4f4de4079130df53a9bebfade09c816d106b19693f69c1fd65b605db801eb19795a4a036f269a25857551070
- SSDEEP 1536:W7ZrpApojOPG0PGQJwFJwkpe+eTDPfFpsJOfFpsJCAdCjHKPNK:6rWpcOPxPke+e3fFpsJOfFpsJbgEc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 190KB
- SHA256 f2d8da1f2ed7b9c7aec2135fe07b283923c21e3d8a87cb4e8e804afacea5b874
- MD5 9137a4d81afc8600367c4d8b53d44344
- SHA1 77a8dfeb0a3bac45f1639a69e7122e4cc8e5f8b6
- SHA512 84778ff2cccee59cad706c859bb855ece8b6b8b2e9e8d7fbbe527e88b17f8692e35dfedbb49ec6985a149524daa80d03e285a695b1fc3fe9b4424e064e2f1ffe
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgECWHIjN3tj6qnv0b2UrXkbvL+:tFPxPke+eIlIjNDv0bNXkbvL+
- MD5 SHA1 SHA512 SSDEEP