Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe
- Size 47KB
- Sample240613-jk9mkatelp
- SHA256 69d381cb78c03f088c83fda3c299a540e032083a7e90afbe30cfa34368381c00
- MD5 6a1836ec407359ec0a027fa7f1325c30
- SHA1 a94822febe50399de64a99d703e7631b6ddc691b
- SHA512 984242687d5fdb8ef85fa6e1683e3de690391add2b2d10e0c21eab20243686d35f071fbc36a3453b64cad747096f6727a62f94dd3f0ac2221c6571cfa53299a4
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFAHsU:W7BlpNLpARFbhblkYlkuvIYFdU
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5352) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\blacklist.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-memory-l1-1-0.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.WPG.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationClientSideProviders.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Controls.Ribbon.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\javafx_font.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-oob.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSYH.TTC.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\uk-UA\ieinstal.exe.mui.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ppd.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\cldrdata.jar.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-oob.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\PresentationCore.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-180.png.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.VisualC.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClient.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-phn.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\redshift.ini.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-pl.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OART.DLL.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FREESCPT.TTF.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ppd.xrm-ms.tmp 6a1836ec407359ec0a027fa7f1325c30_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 47KB
- SHA256 e5f110fa99d08606c9fd530119233ce66c749d2e8397175ad1663f227fd1fec4
- MD5 bf434ae291f3e35711c18e45510aebba
- SHA1 e30ee9f7de9a89001186a542dc228b6a27ec7ba5
- SHA512 fa125715d4352c849c58a976c85446c1fe25aa6a22b435b299d12671a5777291965d7eadb420507f28c3040958046585e38f262b36e756cacbe617698166695a
- SSDEEP 384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFAHsgl:W7BlpNLpARFbhblkYlkuvIYFdgl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 146KB
- SHA256 1f631eafef4f742324178e5055859468889d7c1f0850578db775d89eb3b2a308
- MD5 ae6a0445790a15aa075199107ed7d157
- SHA1 e5e1e386ac95998a0bfae2d52165430ffc2a2a53
- SHA512 de30a8a069dedee3eb48d3f51d988e4a20a4bf1e28d408cba52fc76b624416e2f37de2a4d289a0e022e574327c220c68fb6cd1c9506635f1d665f988845cee83
- SSDEEP 3072:6NLWpCZLYkWHIjN3tj6qnv0b2UrXkbvLN:u6SYHIjNDv0bNXkbvLN
- MD5 SHA1 SHA512 SSDEEP