Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 02:49
Static task
static1
Behavioral task
behavioral1
Sample
5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
General
-
Target
5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
-
Size
97KB
-
MD5
5884c891bfa55e1d2aac42d1fdac0690
-
SHA1
92682b52665072cec611f5a506216f5de2f22340
-
SHA256
4885bf1891f18d4ade0835a78f1d346dd95f244ed6cd9cbfe24ac1684a0ba73e
-
SHA512
e1c350beb712ad1cb5442a7a0475ce95a45db079f3f1ef743f8814b5797a5ccb6086a13efd59ec5ee567a96fff96d6ca8b9947123663e6889951bdb3d606bab5
-
SSDEEP
3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB0:PqFF2Ie+efsim2f
Malware Config
Signatures
-
Renames multiple (4726) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\Welcome.html.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp 5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmpFilesize
97KB
MD57459f0dc45eae75b2ce8cba34a2cb8a5
SHA1d874b092dd18f1d3171e2f5ffd2dee28ac7435c5
SHA256bf8e5654b27088a6063e05e408766d53cf63d73134c0ca4ffd0c4c24119c27c4
SHA5120920c1ffb2485d721e7c45585c1bd8a88d477c54faed45494e1c53dc87b759b095bcc7a5033dc5aed9d21066de4f6cde7c79f8567e249ed73b5662a7b18c73b5
-
C:\Program Files\7-Zip\7-zip.chm.tmpFilesize
210KB
MD5baa72c64cb1b32ecd740b3d6ae8e3bc4
SHA160783066a4481e98d420e433fbb175376eb844ee
SHA2565c019687a408faa82fb7c88ed19c33c420d894ca7466470107abc41503738bab
SHA5122f985f9b24a1f57a6be5338f9616b262d69e1fdcd8e16a90de149aba8757fa940106a2be5d3051517d16762f9bc9b0d59ea4117b42686d23f7d0c96dae13f8e8