4885bf1891f18d4ade0835a78f1d346dd95f244ed6cd9cbfe24ac1684a0ba73e

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
Size 97KB
Sample240613-dbbfhsvhkj
SHA256 4885bf1891f18d4ade0835a78f1d346dd95f244ed6cd9cbfe24ac1684a0ba73e
MD5 5884c891bfa55e1d2aac42d1fdac0690
SHA1 92682b52665072cec611f5a506216f5de2f22340
SHA512 e1c350beb712ad1cb5442a7a0475ce95a45db079f3f1ef743f8814b5797a5ccb6086a13efd59ec5ee567a96fff96d6ca8b9947123663e6889951bdb3d606bab5
SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB0:PqFF2Ie+efsim2f
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4726) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClient.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationUI.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Controls.Ribbon.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\management\snmp.acl.template.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-phn.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Design.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EntityPicker.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemXmlLinq.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-pl.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\DocumentFormat.OpenXml.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\mashupcompression.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\WindowsBase.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Trial-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-ul-oob.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\msipc.dll.mui.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.DriveInfo.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ppd.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Web.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClient.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.Extensions.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.Windows.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProMSDNR_Retail-ppd.xrm-ms.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5884c891bfa55e1d2aac42d1fdac0690_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1040,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8
1⤵
PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp
Size 97KB
SHA256 bf8e5654b27088a6063e05e408766d53cf63d73134c0ca4ffd0c4c24119c27c4
MD5 7459f0dc45eae75b2ce8cba34a2cb8a5
SHA1 d874b092dd18f1d3171e2f5ffd2dee28ac7435c5
SHA512 0920c1ffb2485d721e7c45585c1bd8a88d477c54faed45494e1c53dc87b759b095bcc7a5033dc5aed9d21066de4f6cde7c79f8567e249ed73b5662a7b18c73b5
SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyB2:PqFF2Ie+efsim29
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 210KB
SHA256 5c019687a408faa82fb7c88ed19c33c420d894ca7466470107abc41503738bab
MD5 baa72c64cb1b32ecd740b3d6ae8e3bc4
SHA1 60783066a4481e98d420e433fbb175376eb844ee
SHA512 2f985f9b24a1f57a6be5338f9616b262d69e1fdcd8e16a90de149aba8757fa940106a2be5d3051517d16762f9bc9b0d59ea4117b42686d23f7d0c96dae13f8e8
SSDEEP 6144:PqFF2Ie+efsim2YJ3a3LXGZkUcTb1JcrjQ4Y:iFF2+im2YJ3a6ZHcVar04Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads