Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 04:22
Behavioral task
behavioral1
Sample
1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe
- Size 122KB
- Sample240612-ezh1ya1bld
- SHA256 be0847e0a7d527e35e7183bec21a7b354e30709e01d6140f9da5da053c9cfa4d
- MD5 1df544fd918df8929f5d2088606b0370
- SHA1 64a347710561467855298a235051bcbad6aa7fa4
- SHA512 5fbdead0da3daa1bbbf457d10998e872c3abe8ec36d85d1fd228ed428c8847dce6c9bb7ad25e32a35010ebf7c6c1764d2f3909b91377d392684ddd6f601bff80
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8iLRLGXxXaTWn1++PJHJXA/OsIZfzc3/t:fnyiQSo1LRLGXxXSQSo1LRLGXxX5
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1148-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/1148-1836-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\server\classes.jsa.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ppd.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.RegularExpressions.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlDocument.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-ul-oob.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-100.png.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Office Theme.thmx.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\javaws.policy.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.resources.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\nio.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationClientSideProviders.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-pl.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.FileSystem.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-pl.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlSerializer.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Primitives.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll.tmp 1df544fd918df8929f5d2088606b0370_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 123KB
- SHA256 63faaa41ab9a902b94f5235228e8c64c3b15e4044c2307681bafe39eb586d8f6
- MD5 cfcd10b6fa5b6a7beef42ea85ba5a35d
- SHA1 489b597f0909d49b2d3884c31f82e74120f2ee5e
- SHA512 41583eab4b2d8d23f528daf7cf90f8a278ded4f57cbc1de2c3fe70e159a024e3c2c0d6d41d20ee9329ba51851fcdaa4d9aa0021854d79cf4b352054d2077029c
- SSDEEP 1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8iLRLGXxXaTWn1++PJHJXA/OsIZfzc3/P:fnyiQSo1LRLGXxXSQSo1LRLGXxXD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 222KB
- SHA256 b9ba5e898754a30b41b2f9e0f9ce696e8919f0ae61bcb3ccecd6539909dd5244
- MD5 e04827a615a3af95eec3abcaab9ae3ab
- SHA1 4b78909876f3d1466fada27c49aa28d3bffe4d22
- SHA512 8a8e6a7689969ebeaf8b2b66f1edf972b1a56720c559efbc5de44dd59c6dbc873b98678021a5c192f0d834fba2024f4cd71e392111d6404ac35411d5cf2d0b7d
- SSDEEP 6144:KiQSo1LRLGhCQSo1LRLGhCIjNDv0bNXkbvLa:VQtJQtHIZGNXkbvLa
- MD5 SHA1 SHA512 SSDEEP