Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 22:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe
- Size 90KB
- Sample240612-2nqb7stdke
- SHA256 93d1a13f1d24493744978ea27e5c65ec3bd911cd8605c7fe973f769317dd2316
- MD5 4a3e961b546ededc52794890d598e300
- SHA1 215a0143775f7e045b9b05df47505b2b5a56b21f
- SHA512 38de23124327d5fc55e80af8406abf95b1afc36c940e529b5422648879a83f0ab09dac285284ad5635d85d47da3024410b5cd133ee5474707605349f5366b748
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76stg:6e7WpP9oVLQthbYY9oVLQthbUvu
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5174) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\plugin2\npjp2.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ppd.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_ja.properties.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\local_policy.jar.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\msipc.dll.mui.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ul-oob.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Timer.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-pl.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClient.resources.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\uk-UA\iexplore.exe.mui.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jfxmedia.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.Authorization.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Http.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.DataWarehouse.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.Brotli.dll.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\InvokeOut.temp.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ul-phn.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 4a3e961b546ededc52794890d598e300_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 91KB
- SHA256 501a8af7fe667ab9be2f38b3db11ce5f2b4346486b581ab5d00b923ffa1d497b
- MD5 bfd5a78e07a76e57c855308723955e6b
- SHA1 016c6f686e6f8540658a2fa139923811e6cf714c
- SHA512 8e2071e4e19faf99ddd3b3067cb3a25826b70f3200b7f6ba8b626ad35084aa804af3dc4a761ec5bc7afa1f5c4fdd8fe0fa0d9df75bec09bd6b60027c60c3e2a1
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6b+W+V76stJ:6e7WpP9oVLQthbYY9oVLQthbUvv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 189KB
- SHA256 8f76e4d53c95d7921c7bfe3521f0761536aca0ebf7e808e830f0625cbb4fc4fd
- MD5 9da18e1843f4f67a1aec3df0c48780f6
- SHA1 510019be9ce4b7cdc72ca6829f68e47e1cd66e26
- SHA512 8d2a7e60ab56e844d652c9b4573081e33d8afea21543c410ae19cb86cf2f93f7cdaa5a02aaa803e20ec92fba9d4bebaaf6da27e3830efd110ff7d67957e31b09
- SSDEEP 3072:6e7WpP9oVLQthbYY9oVLQthbUvjWHIjN3tj6qnv0b2UrXkbvL2:RqAYIjNDv0bNXkbvL2
- MD5 SHA1 SHA512 SSDEEP