Analysis
- max time kernel
149s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe
- Size 76KB
- Sample240612-2yc5maxgnn
- SHA256 3a37f66e049ab2cdb5f271b1e900024813cf89cfe330e31b6eaf2e3768b44fb4
- MD5 4b12a637cc48968933c28f22c434c190
- SHA1 e09588b9247e519cbcb92ddbc26a5ed5b730bbd3
- SHA512 865e564df53fabe1a410478a9f2274b19cdb0fe5f47786913a844c8a8801dde5bff5cce3792c0f797176f9346485e289c30251bec9d974fab7821ebfeb440e09
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhN:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsM
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5022) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\WindowsBase.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Extensions.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial1-ppd.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\LTSHYPH_ES.LEX.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\lij.txt.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_sv.properties.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\3082\MSO.ACL.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMT.TTF.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationProvider.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellModel.bin.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Design.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ul-oob.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\ssleay32.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ul-oob.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationUI.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ppd.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Xaml.resources.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-pl.xrm-ms.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\lcms.dll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fr.txt.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp 4b12a637cc48968933c28f22c434c190_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
- Size 76KB
- SHA256 1c76465ce5b7e3aa6ac13a51f12dc628f1acf12d3ff4515367a73f84a23f38dd
- MD5 a60c87c170e08f23ef3a38244fafe769
- SHA1 83faa040ad2ed348f5d837e7a1cd66836f4aeeae
- SHA512 64ea30d6fb72630bfb512022fc803d2eb41e51fe8d5eaf78d811bd17f1ad40519ff7177c9f37cc35260d5270d4fe12b46e9620683dc886819a160e6781da4144
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhQ:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 175KB
- SHA256 51b5219c7eb8c618102d34ecac48d99ac254bf22243e0f7347a2039d3b950eea
- MD5 4f748f4dbaf61e88f8b7271430bb18e7
- SHA1 f22973be8c08f79510ef8ea5999c2a4e8a773d36
- SHA512 b96f3c3392faa73d640b053a96038852794f77ca194d4e3903558163b4077b0f947cb103f187b25faab828f748171110f1012c168cde640a8b2eee7a59da60a9
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBp:PqFF2Ie+eFjIjNDv0bNXkbvLD
- MD5 SHA1 SHA512 SSDEEP