Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe
- Size 89KB
- Sample240613-mmscvaygml
- SHA256 eb5770ed4f00899ba89f04b62da2fc4ced492faa41ff78006686ed8bfa78da5c
- MD5 7505cb972bf832b50fcbb00196df9360
- SHA1 1c1cd0a037bf82ec4b1ffcf54ed2f2595385c379
- SHA512 92b44010a8fecb7cac5924f5e92833efc89faec26a954cc6bd0559298ae4cefca0fce30aeb7d204ef49803818d224c82f1919344a94d1e6829c4a9b98bb7ba9a
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPlsq:6DWpwE7oL2e+efZwZ08i8Dsq
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationUI.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Controls.Ribbon.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_100_percent.pak.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ppd.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sw.txt.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterRegular.ttf.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ul-oob.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationProvider.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\wsdetect.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL087.XML.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsBase.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Extensions.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsFormsIntegration.resources.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\hy.txt.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Extensions.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Json.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackLetter.dotx.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp 7505cb972bf832b50fcbb00196df9360_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 89KB
- SHA256 cc5d5f28dffa83ab53b79283e13f9c06a9f332bc8326565c7ec1708dd54ae60d
- MD5 cdefed761e4c96c89a8392d21de9e6d9
- SHA1 af5c3c6658d205fd1188ead46b74671c9e39ed90
- SHA512 82d482e7686c839f48cbe7c7de338ccfd3d0edaeaab19cb375ac17cdc57655323b2f6a6837d2d888d76d14a4eef9239969d495e25683c71c9f22b2aa96e2f149
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZQ/8S/80PqPlsu:6DWpwE7oL2e+efZwZ08i8Dsu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 188KB
- SHA256 574a27a1cb249f7748f3102c29660401f8a5e8f35084f62d0a60017f4f066fba
- MD5 9c0b3a0e69ce1060b1cabc3c317d7e1a
- SHA1 41aa0ec5443094ab2a370186798afb82d639fb61
- SHA512 2db0c805dbc627f064446d0c3a8c9cc28c519a081e9f8a204e6abc252da116c67af3a11bb5a847f1bc25030a9e42e0668b3ab836f898b31afc27f423fb8f4497
- SSDEEP 3072:6DWpwE7oL2e+efZwZ08i8DsDWHIjN3tj6qnv0b2UrXkbvLS:dN/e+efimJSIjNDv0bNXkbvLS
- MD5 SHA1 SHA512 SSDEEP