Analysis
-
max time kernel
150s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 01:56
Static task
static1
Behavioral task
behavioral1
Sample
552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe
-
Size
156KB
-
MD5
552f8aca4f90d8c541947094a0791c40
-
SHA1
05a21e5141a4aed8f558241521831e54b05c9861
-
SHA256
f16c5e2a6af2844e0d5104681625cb37e3a25ee88a990abf5e7f6f9a8f38be93
-
SHA512
a4efe378c2a323d687fdb8cc04de7d69283bf556e0c4d22809e748b4bd6f908b5785215f1b217daae57a03bf85300cd04a92648826493dd7bc6fe485abae175b
-
SSDEEP
1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/8pTmXadjUSbcDemTPAZk+cLtdNlb9NEV:6DWpwE7oL2e+efZwZ08i8p6W2QZwkS7u
Malware Config
Signatures
-
Renames multiple (4843) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Grace-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ja.txt.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationCore.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.CoreLib.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\WindowsBase.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Primitives.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\WindowsBase.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Metadata.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Numerics.Vectors.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL118.XML.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\fur.txt.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Trial-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-180.png.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN026.XML.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Loader.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\ReachFramework.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ug.txt.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Grace-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationCore.resources.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansRegular.ttf.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-private-l1-1-0.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\salesforce.ini.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jfr.dll.tmp 552f8aca4f90d8c541947094a0791c40_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmpFilesize
156KB
MD53b82957b20894a6782edbcba96ba6030
SHA170dd8dfa241b1563207c550e4583643787ee1992
SHA2564a3fb507ccd5999adbdbded617bd70dc4e8a9b513657366666a7b74c64d98e4e
SHA512f876816191d7e839b7fe162fdf5f6321cc5842f42caddc51da68bf2b9860739bc3eaf36b30ab1ac60295a77dfe652d869d2510992baf6c4c5dd93d90161edbc0
-
C:\Program Files\7-Zip\7-zip.dll.tmpFilesize
255KB
MD568232ae7763355d49917f58622d5d7d1
SHA1636401ce966a386d77b238014d753e0b5ad57ade
SHA256cea9d9bfc99734d123b4f094223cc63c79e9d66ff3e2ccf30a5cf8649787c082
SHA5125b23e021ae1d6eb5aac4c917c31ea36e3ce878416185f860a7692d31056bd6b1f5f8d8fee229457ae313ca8455540d7d25672ab3962ce36535bb80d29f03c940