Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-06-2024 11:40

General

  • Target

    3762da172002e778d48ae8959a69d260_NeikiAnalytics.exe

  • Size

    89KB

  • MD5

    3762da172002e778d48ae8959a69d260

  • SHA1

    33cb5e6099880411b9e629e56cf88fa7171e1702

  • SHA256

    4410da8a6e92916727b79dd2629f5eb24b75604f7487bf2cfba981389be06fff

  • SHA512

    a613cc1490ab899de37c469bfc65c64e34a0ebcd1ed4f1b7415f312f93c5cfb6ea1dfcb50954292d63e820406e3854860bbd26027cce1f8f0b157ea7c8feb9d8

  • SSDEEP

    1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tITcfNrRk7VP2DzpQAP2kTg:6e7WpP9oVLQthbYY9oVLQthbUrt7tIT1

Score
9/10

Malware Config

Signatures

  • Renames multiple (3463) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3762da172002e778d48ae8959a69d260_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\3762da172002e778d48ae8959a69d260_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2297530677-1229052932-2803917579-1000\desktop.ini.tmp

    Filesize

    89KB

    MD5

    65ef45fff503c63491c75540a7439da9

    SHA1

    3bdd9b208b3b0aa520b06878e38245318bdc2122

    SHA256

    1484ae2f13444ab3b15f0823011adbd0d4d0c1a19b3d23900bba1c59cffd65cb

    SHA512

    9c11cf5106da7f1b3510b2804fedb4b65a4242e77e539ee72942908637957f2ca956bdbb3bec4371268cc08a1767999f19e51c059488b440f71ceab609001cd1

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    98KB

    MD5

    3e0af3f7d699edac33cc1ca25c42c901

    SHA1

    263ecaa6fd0e1fbf7ee2846acb1bb7ff4dc33cf9

    SHA256

    85dd82c88d04b539cd8b516baf5660ba57f1f19d56ce38236645f657afecb15e

    SHA512

    e2dc14b3ea01d3ddd3028877ae2ce0e24ba324d759ad4e8f6d15bb6ce867b9ead719088795978af9ae980dddaf1ef1932d00c6981138217fdad5970cc607fd2e