Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 05:57
Behavioral task
behavioral1
Sample
2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe
- Size 360KB
- Sample240611-gnlc2axejn
- SHA256 9c374d1bfb31baf47b574d94b78de4a30fe0fc65c6e4c2a02dbd6e43eb4b55ec
- MD5 2a142fdab9d745b39d156c8853417f00
- SHA1 9c7076842d90df1afddad70f1893e22cfa534427
- SHA512 26cf1a0893c2a8e12cc6837ae3e4328b8c8f77319533bc8663117b52c112ded2a2cbbb9da8f633b905d76c6673d270919bcff6139200cbfe916075f9bf04688a
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIuiQSo1EZGtKgZGtK/CAIuZAIul:VQtyZGtKgZGtK/CAIuZAIuiQtyZGtKgc
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4160) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/2200-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x00090000000233ee-2.dat upx behavioral2/files/0x000800000002294e-6.dat upx behavioral2/memory/2200-1416-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore_amd64_amd64_6.0.2724.6912.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ppd.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-pl.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-phn.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\vi.txt.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-1.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.DriveInfo.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_PrepidBypass-ppd.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.deps.json.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ShapeCollector.exe.mui.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ppd.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-heap-l1-1-0.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2native.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-pl.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationUI.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MsoAriaCApiWrapper.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\gstreamer.md.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow Orange.xml.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-pl.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ServiceModel.Web.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Input.Manipulations.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Xaml.resources.dll.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ul-oob.xrm-ms.tmp 2a142fdab9d745b39d156c8853417f00_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini.tmp
- Size 360KB
- SHA256 10b40b46a8e0125d3de9a1306a09f125ed8e32b28533186c527d421e6ed9ce90
- MD5 542c521a0ff697a742926cde1d95d202
- SHA1 143ceae8dddfaafefe281aa60975699ff01ca3c9
- SHA512 84aac5f57f204d6b5e91c230e9472bea5268c45ca73a1c73a3d8763d176ffbe9150cb7fbcd87fceb1caff839ea51663d88541e3c5d17cd177e5c77381e6345ae
- SSDEEP 6144:KiQSo1EZGtKgZGtK/CAIuZAIuiQSo1EZGtKgZGtK/CAIuZAIuD:VQtyZGtKgZGtK/CAIuZAIuiQtyZGtKg+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 459KB
- SHA256 9fd52341a1e68f50b7a70c0cf9494a139c797734d50ca8b63c27056daf0adda1
- MD5 7b6d15be95d955b60b2acbbc2790f540
- SHA1 e6428b4dfe1271d1c95173b4019096c7c339568a
- SHA512 f2a6258c6873d2920aba22f1653094f1bcbde5b6037fed704e1a00781087af469e926c04e5deb32c10791f6853dd2294da792226769e5e0dd25a2c6565afc7f6
- SSDEEP 12288:VQtyZGtKgZGtK/CAIuZAIuiQtyZGtKgZGtK/CAIuZAIukIZGNXkbvL1:VItXIt3IZaXkbv5
- MD5 SHA1 SHA512 SSDEEP