Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe
-
Size
78KB
-
MD5
53aec8dd5de82c1c2da6942706e5ea60
-
SHA1
d7f7714a09d28dec3ed7c149fbeea979148bea39
-
SHA256
50ca0a9f93c1f8cd2af7e7f375b9cffd56f210c81d0d95149fd610242fa2932d
-
SHA512
83f26688616ab0bcd8e152acd00c1d3c705b8713aa62af2d4695d80547bb1cb3cec37fa6d27f98b5b73af3773b3150c4368ede13340a0e7a1f37ce49cd3aa003
-
SSDEEP
768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hH5:W7ZDpApYbWjIlE77ufL2e+efZwZ2qhS
Malware Config
Signatures
-
Renames multiple (5032) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.Extensions.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\public_suffix.md.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-pl.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\cldrdata.jar.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-100.png.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt-BR\msipc.dll.mui.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Expressions.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-pl.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ul-oob.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Sockets.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewComment.White.png.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Formats.Asn1.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp 53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\53aec8dd5de82c1c2da6942706e5ea60_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4132,i,3671441404766730751,12082497324212183132,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmpFilesize
79KB
MD57ea722b8979594dcd8f96a69155ba994
SHA1650ddae805fadd0249bb653455aa668d2cb4d263
SHA256a09b49640b3d27aa5bc2d44be33af9612eca1d2e614f63c2b231b2d2d4d54ca8
SHA5120172f74537cceba44e56986f47e7f9a5a6e082572d8241578db15cf4156e83a7342251e90e846a529b4c25bc537ec8d48650eb38fc2f331ac9db2f4253501f68
-
C:\Program Files\7-Zip\7-zip.chm.tmpFilesize
191KB
MD502c6e65282a22da3842e1c35be8bd8a3
SHA1bc0a577ae7b110dfc9ad689c7350e7bba96c305b
SHA256437648cb8590752c6656eb21caab74fb850c66a2534f09e65bac15c026cee240
SHA5126fb3708c9d01ad208051ad78c698c9179679f1ba8bba8d5e60ccf406eb61d4f17009daba685224e346fff4869fef0bca254d577fc69e09ab8ac448ff3182f2e2