Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe
- Size 45KB
- Sample240613-bdbg7asapr
- SHA256 09413271dd8252fcb99ed86a35fe3009a80023569232cb4bd76a1bd985283655
- MD5 5225efa3da72e57e7742496d996b0050
- SHA1 0ebd83544d2b85c4047f1e3d737c3883673bb026
- SHA512 b700c9ee49fd1df737d3c5b43c305ac532485f8934707c07d80a619a74f6716a53056012717f1e839e37f4f095e4fe403c3ecb6e541a866bff74fb8a816d9e3a
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDS:W7BlpNLpARFbhblkYlkuvIYFWcDYcDS
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5346) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-pl.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SQLENGINEMESSAGES.XML.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XmlSerializer.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ul-oob.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Classic.dotx.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\sunmscapi.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.HttpUtility.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Linq.Parallel.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClient.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-time-l1-1-0.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemui.msi.16.en-us.xml.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\MSO20SKYPEWIN32.DLL.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART11.BDR.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.VisualElementsManifest.xml.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\PresentationFramework.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\concrt140.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\ConvertFromClear.css.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Accessibility.dll.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\sound.properties.tmp 5225efa3da72e57e7742496d996b0050_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 45KB
- SHA256 ef8400bcb250bd0e14768b0c1305d2cd9fa7728e62623c4919fc7338738bf56c
- MD5 48fca3809750010a6e51cc4299c34516
- SHA1 ff5f050e23704af60f3f485c816c9305d5fe79b7
- SHA512 1f0fc309f561f3d6666572a8d3f3da5295e7e3d911f4e9cfcbab20e438dd5c459e4a9941e215e942b7cff8bbafd4126e76b03c52454b9430a803ffb62644bf51
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDL:W7BlpNLpARFbhblkYlkuvIYFWcDYcDL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 144KB
- SHA256 74c7f094c2531cfeeafe925ad47fec50830613e1cd7c7b8e5ba59c8143034c3b
- MD5 e5086e20ac112635804a2075e9272f30
- SHA1 8504a4ae79e4884c42d4782fb8a1866ef6fbe660
- SHA512 7237a3de2315beaac0133cbcb17ba23d0edcb18c134650b2a0770c8e418c3ca4cefcc77fb16e26ceb669e2b9ac22c1572cfaf468ca3ee3b1abc6f68ce07e66c8
- SSDEEP 3072:6NLWpCZLY8WHIjN3tj6qnv0b2UrXkbvLh:u6SY/IjNDv0bNXkbvLh
- MD5 SHA1 SHA512 SSDEEP