Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 22:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe
- Size 79KB
- Sample240612-2qrm2stekc
- SHA256 24d3cd735007d24e8ef50a9958fd71a4abb857d2b5fe7f1671baf9b5fab06453
- MD5 4a7a9642885da1fc9612d6f362c21220
- SHA1 e2fee07b9a930c4a328873698b85af572435aaf3
- SHA512 f659fa1e9b1bbef64fa49890e25363cdacbde94fb0b4babcc9a636de127539a6eae71398c38ca7af5c23e197e296e3315bf454c7359cd4f2a4b5c5ffa3132126
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhM:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsh
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4919) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.ILGeneration.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-PipelineConfig.xml.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-pl.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\kab.txt.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.Editors.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsBase.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\access-bridge-64.jar.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-localization-l1-2-0.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\cmm\GRAY.pf.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\FA000000009.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationTypes.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationUI.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ur.pak.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieXLEditTextModel.bin.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Graph.exe.manifest.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Aero.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-oob.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-pl.xrm-ms.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\profile.jfc.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 4a7a9642885da1fc9612d6f362c21220_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2447855248-390457009-3660902674-1000\desktop.ini.tmp
- Size 79KB
- SHA256 d9ec5e86754c1c8f445ca0fe3abdf39b45a6a086bc5288a338e71f4bc061b548
- MD5 5d90dfd309b9409d78bb4c332e3a47fa
- SHA1 62a18b9e56f2810535ab5a17e519a672c24c4b5f
- SHA512 61c8d769dd3b6c5008ffe96e4f4b8d55ec3221eb25cd2fc77c94af832f12a10d71ac84d47d676c756aa6577147418296e1dd2fbc2b72e61bd63dfec3b6df5ec9
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhe:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.exe
- Size 178KB
- SHA256 06ec85cb002b9e41660c30bdd2e73b3ee56e74d1cb7b8ff214d06996d2e5b6f6
- MD5 224661c0fea63d278b8de16a688266d9
- SHA1 1a5417641bafb38729e99b98e0f008d862575952
- SHA512 5b1157e7a7fbb4bf7ab339ecc688f4e948bb99f32e217b90cd55e5058c500ac9be83e3b418347c9b60f1d93a47b75c29e77a1845c9fd320c70dfbe2916c847fa
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBt:PqFF2Ie+eF8IjNDv0bNXkbvLe
- MD5 SHA1 SHA512 SSDEEP