Analysis
- max time kernel
150s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe
- Size 46KB
- Sample240611-ks7nls1dkf
- SHA256 6538481045a4fdd0a8d329a7ad0fa928f072d01b8a532406f2b2e0d0691a2452
- MD5 2f0deb7ece4e58853fa6c2cedb03d220
- SHA1 ca9e5ba2332b78ae2f11c2a1a298b70eba8a0d1f
- SHA512 be1b107e72d2ae38208ef465ee2015dc143f57cd440a91d04afcba073dedfe6e2a3683ccdc9655dfda716a507e3a6162dfe0b811c0115689097d3785b6090fba
- SSDEEP 192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vh7m/FJHo7m/FJH8wf5Fi5FPzR:yBs7Br5xjL8AgA71FbhvhwfzizP1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5329) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Encoding.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordbi.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red Violet.xml.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-filesystem-l1-1-0.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\ReachFramework.resources.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Claims.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-pl.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.tree.dat.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Input.Manipulations.resources.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\javafx\libffi.md.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Grace-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.DiaSymReader.Native.amd64.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.resources.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\FindOpen.htm.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libssl-1_1-x64.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Queryable.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\PRIVATE_ODBC32.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\prnSendToOneNote_win7.inf.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\TimeCard.xltx.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\ConvertOpen.ram.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp 2f0deb7ece4e58853fa6c2cedb03d220_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
- Size 46KB
- SHA256 72bac499f45d0d1cea45a1d49eeae850b58c9402661b56de352f77d99d2de454
- MD5 7e1b7ece52a5d8dacd554f5e54bb3f52
- SHA1 70d4f0b7cd85ddfb9b410e043a933308f8789f2a
- SHA512 bdbbde342d2551cc313345257c9809c45bb2da4899048c8db2deaaa0dbdcaf1b173efb0e9a884206c24a20c948d8974f19519462fbbee015bddf27aba9d438db
- SSDEEP 192:pACU3DIY0Br5xjL/EAgAQmP1oynLb22vh7m/FJHo7m/FJH8wf5Fi5FPzu:yBs7Br5xjL8AgA71FbhvhwfzizPy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 145KB
- SHA256 e5e76509441a21419e45c33a15ce27934e2343095504caeed45fff8cc504026b
- MD5 417cb5cd3f8489d53071d344bbad5c76
- SHA1 7629e3057f001befe8f56cd26d514820863d766d
- SHA512 26bc66d864674bd6824e917790640d523544089f34bad0c4281824c675b292c6f1233c15e49f824f632b55977ebc502dae90c9caa7b37e180a87b8e23851f30c
- SSDEEP 1536:/7ZQpApa4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DdX:9QWp5WHIjN3tj6qnv0b2UrXkbvLZ
- MD5 SHA1 SHA512 SSDEEP