Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 12:17
Behavioral task
behavioral1
Sample
3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe
- Size 118KB
- Sample240611-pf7kaswfmc
- SHA256 752a5aef2d695a06be70a74c8715f69f60aa3c776bc442b35a928291e04d3535
- MD5 3492855a465e64d4a4d4e76b0353d820
- SHA1 30ea90152fc9b3d1e3f68c4501b5096b84e0a164
- SHA512 f28f597c7f8dcdfe9dc8015de50850ac46a7ea659c6fa91ecd100f7e1b62ac1fc6bd88a95ed2c690629902b0621dec51c50f41dd7b4526e167f03e53acea375b
- SSDEEP 1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfagh:hfAIuZAIuYSMjoqtMHfhfagh
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5048) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/3592-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x000500000002328d-2.dat upx behavioral2/files/0x0008000000022970-6.dat upx behavioral2/memory/3592-1088-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationProvider.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsFormsIntegration.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7en.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ppd.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\local_policy.jar.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\resources.jar.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\WindowsFormsIntegration.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\icu.md.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClient.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\deploy.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\classlist.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7ES.LEX.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-phn.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.DirectoryServices.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp 3492855a465e64d4a4d4e76b0353d820_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 118KB
- SHA256 59e46eda41513dc651d91cec34f9d2c700b59aad30ab2b02ad538abcc218f88e
- MD5 44c00037e3ed9991840778f5a81aac2f
- SHA1 8bbcf9365a2d1db467cfc5c3d89a696f0754093d
- SHA512 5d601701bac063e44bb6bdb7ac9783cd775f7daeaa4f8e72caaef1029362cde2329f1d691ce98e86b84066c5854223e8e37cb31abe8ffcc75f047d9d945cef83
- SSDEEP 1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfagh:hfAIuZAIuYSMjoqtMHfhfagh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 217KB
- SHA256 a301f2b67134a55972f5543acd5b1a668531f7707102d31f226f3149f74eb3b5
- MD5 1a131cd89e37dcc6df4256dcc531b1c6
- SHA1 6d6f0b401e25476fce510ffd514e672736626c82
- SHA512 7aa326cc7a76606529fcd813aaf5065bc3ea6e2c1eb7037946e37bcf87da75c0d91c277df04ad9240d7d95ef94abe4c7215c76859e0264558548e76341c28523
- SSDEEP 3072:hfAIuZAIuYSMjoqtMHfhfagKWHIjN3tj6qnv0b2UrXkbvLw:hfAIuZAIuDMVtM/sgtIjNDv0bNXkbvLw
- MD5 SHA1 SHA512 SSDEEP