Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe
- Size 46KB
- Sample240612-e1dgva1bmm
- SHA256 b65e55bd0d4bf0b4ec8907f8f22e051e6d0774fbcf777d4584a91519d40ce84f
- MD5 1dfb060d2897616443c66846f1a3dee0
- SHA1 bddc8bc827797017741125b668a3ff354c4e8653
- SHA512 7efa86b7e796374596b3f02b779cca8e8889b5af3af0c4fd445d6a9270756b26142cb5cd88cd051c5cea91e2d961445f825abc2f6b1a9e163ade52bbba88d56f
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNAv:W7BlpppARFbhWJQiyv
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5369) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ppd.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\DenyComplete.htm.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-phn.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ppd.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrjit.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationFramework.resources.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationUI.resources.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.VisualBasic.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.DataAnnotations.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ul.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ppd.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\ConvertTrace.mp3.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsFormsIntegration.resources.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-localization-l1-2-0.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ppd.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.StackTrace.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-180.png.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-stdio-l1-1-0.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Input.Manipulations.resources.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadce.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Trial-ppd.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-phn.xrm-ms.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\he.txt.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp 1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1dfb060d2897616443c66846f1a3dee0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:81⤵PID:4624
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
- Size 46KB
- SHA256 2bbc73ffc8f499483905dd07cc9ad8b4e2d908210274fe91731c5d5667ce9f53
- MD5 78fbd80c6cd1c00e910f0a4ef56d2f69
- SHA1 1b46ec8b90071a9a507122812dc545d88e12ddae
- SHA512 cb9a693b89682240995a50611bfd2a23b7a0027a159a615da9cf426cc50559a342c0100e08e8cc4f84b18632e3ed4bbe8924cca30b3db03b9758ba633c4257da
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNAW:W7BlpppARFbhWJQiyW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 159KB
- SHA256 f04075cac633283f3e99761acf93734aef373d461132c53130ccd012fca46af7
- MD5 936f67a630ba6ed4d069429b3c485872
- SHA1 c8dde146225d8351caea177daccec813751582b9
- SHA512 e7d62936f71fd253c49c75b4ee427c898b4fd38369548e36f11329c212e37127570200e6f5068dea046e30382574fdc6e307eae03a33f58eb8bdf832db55264d
- SSDEEP 3072:6pWpHiZJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RP1:PIJ3a3LXGZkUcTb1JcrjQ4/
- MD5 SHA1 SHA512 SSDEEP