Analysis
- max time kernel
150s - max time network
56s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe
- Size 48KB
- Sample240612-e3fpzs1bqq
- SHA256 a71a6276ec01abe9b495455eead247a69f48f158ebc01231acb0938a62ef3f22
- MD5 1e25c825a84c5953146cd491c953fff0
- SHA1 5954d1ebc95d6ca71d564b96776084516d65552b
- SHA512 9f23ca40b7184fcac7ad277d917c6cdb02cf9d46423542a31e39ee08b6ef3e4308b108656a9143f7741109fbc65bc947e9eb3cf4f06e025c7340ce65c047740d
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNYxyVxa:W7BlpppARFbhWJQic
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadds.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXml.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Encoding.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationClientSideProviders.resources.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymt.ttf.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado15.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\WindowsFormsIntegration.resources.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-pl.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.Vectors.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-80.png.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_KMS_Client-ppd.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.winforms.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEXBE.DLL.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul.xrm-ms.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXC.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.Edm.NetFX35.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONENGINE.DLL.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\OpenSSL64.DllA\openssl64.dlla.manifest.tmp 1e25c825a84c5953146cd491c953fff0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 48KB
- SHA256 517e09099cc77327d9e6f0a7d4b9e4ee8372c6094556191b8b2dcfa08845c804
- MD5 cdbc7a82648342923da281c6e28354ea
- SHA1 0fc66d1252daecc3b43d0995f626bc8b7ff1fe67
- SHA512 c59e56496b386d715f2aa39d743f4edfb6f4518a99cb8a7e172f35df5c9dcd571a133047b15b5f0cc8cff972fe40e74ef84ec38383731c15a4370040cfe120a5
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNYxyVxV:W7BlpppARFbhWJQi7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 147KB
- SHA256 5d40d09e322a40afbd77995ad4c5451161bf2b93545c7d67258d7ee97e3af688
- MD5 42a49e1c21de7cd590a1d68338a1101b
- SHA1 cc3de3968d45b2ff7eabd74150e355edb58ff5ab
- SHA512 cf506223659e59cb95357e11d75a01c76f8fddcaaedd8fbd17f04fd971811ab194e005bc7a1a2949048978516bdf7ab4ab6972ef385645a29a18beb91c38f25d
- SSDEEP 1536:W7ZppApHiE4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddq:6pWpHiHWHIjN3tj6qnv0b2UrXkbvLU
- MD5 SHA1 SHA512 SSDEEP