Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:42
Behavioral task
behavioral1
Sample
69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe
- Size 68KB
- Sample240613-jjn98stdqq
- SHA256 42e1559d00452648ddded699487541b63172577ebaae19379d8bcde01f9d8bc2
- MD5 69f125f0057656ac25a8b9f84d1ef0b0
- SHA1 932abe26049d0dbe1d51bcd5848394371214080e
- SHA512 3dcf9fa0ee4c80724b2dbb28b78e71a26085468f125fafdcc3801c38c4d9ce6a8f95bea956b7c7f949835b485b3f2f625e995d949f0d88f53d10379af9605c4d
- SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZBX5WX5k/8S/8X:+nyi4MO8i8X
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5273) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1240-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000022f51-2.dat upx behavioral2/files/0x0009000000022979-6.dat upx behavioral2/memory/1240-1968-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\RTC.DLL.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\ReachFramework.resources.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-ppd.xrm-ms.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\DSMESSAGES.XML.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOS.TTF.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\ACADEMIC.ONE.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\coreclr.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Dataflow.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationProvider.resources.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\icu.md.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\co.txt.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\master_preferences.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\currency.data.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-CA\tipresx.dll.mui.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\ieinstal.exe.tmp 69f125f0057656ac25a8b9f84d1ef0b0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 68KB
- SHA256 7f1fca7ca5a53bd776e0fd57f6747c34661de60de497949308bc06471d7988ba
- MD5 2928bf1f9bfec3c626a8858ff20a6677
- SHA1 61c750375e16e82022d29022cdcc132480d6473e
- SHA512 ba3bb9c98a4418322f1e7b26fd91ecff17c4cb51f09441d66f9e7891f9211744a057bb16e3dff9ff4131ef6072eb35614e9a15ec66efb5e66cbb4ed452e8fa96
- SSDEEP 1536:67Zf/FAxTWY1++PJHJXA/OsIZBX5WX5k/8S/8A:+nyi4MO8i8A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 167KB
- SHA256 2340646de6429af3f39fc7b635fc86bc7911f2e28a9d016553d6e393b473d9bd
- MD5 3c68d192dd7dd98baae8d363e2ad5434
- SHA1 35541a727458378dd98c8170046784b2693f1bd3
- SHA512 045a0785d3ec14474cb0b016c824b37c63b7f30051511b6b6c7b6a0a27afbc13c6915f43c68c6a919bf0a05fcea9356dfe264d96a9aae02b148d2677aea82233
- SSDEEP 3072:+nyi4MO8i8CWHIjN3tj6qnv0b2UrXkbvLm:Ji4MOJ+IjNDv0bNXkbvLm
- MD5 SHA1 SHA512 SSDEEP