Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 20:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe
- Size 45KB
- Sample240613-zb71dazbnb
- SHA256 426707c81e3d5988fb91045bb6934be510c4ed918b16cfbb27355fa083d6beb7
- MD5 84aac8f1b1370aa842742d43860abec0
- SHA1 67a143dea86aaf1ad89e7a7e9828abbf3f801546
- SHA512 da9c97f162cb18d13856aede4f2a9afd8b01001c752f6d61c7f4baaf55844c520e7da6ae1a18fec7af9f2116ef7f27225ee39de18c8af565b1c94d90b920cf3c
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKr+nk5ZTaVkwrJ04KkZtk5ZTaVu:W7BlpppARFbhWJtkXT9SQXT9S2
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5285) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\lib\jawt.lib.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-phn.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\STSLIST.CHM.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Serialization.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationTypes.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClient.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGI.TTF.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN096.XML.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Controls.Ribbon.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\manifest.xml.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ba.txt.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\tzdb.dat.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\gstreamer.md.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\csi.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.DocumentServices.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msproof7.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.SystemEvents.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsBase.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Uri.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\UIAutomationClientSideProviders.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\splashscreen.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationFramework.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-oob.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\jvm.lib.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\npt.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\splashscreen.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7cm_fr.dub.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 84aac8f1b1370aa842742d43860abec0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
- Size 45KB
- SHA256 4d365be006b983f8b4d1d25aac9dcd0f23076bf8ea2b941a91ef0adbd79935df
- MD5 6609f28d77efb2dc0467c359d2f503c9
- SHA1 68f8a71b794ad2b83d88cfacd56f195fc4f67d97
- SHA512 ffb338fadda801ee4c72ede524a2f428968c8c2de856ddc616e91b3c16d9be53324979b2514f969f3c10f684a389357a2fe80a7cec6526ad289be6a54de23813
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKr+nk5ZTaVkwrJ04KkZtk5ZTaVG:W7BlpppARFbhWJtkXT9SQXT9Su
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 144KB
- SHA256 28612f408c084e59dc87f7bd3201359c0cbe465fc53dda25b75ce75ad1ee3a77
- MD5 768472666f043d85735f037d816fc27e
- SHA1 7676ad002c60463bf12d75539325f7675391b641
- SHA512 9516e2c1199cb8bf99eedd219f06dae6486374bba4e599921a746a1e34b0e7ce84235d94a57319ff5fdcdc7c52750febda96c63b51c41fce7cdc73199c757ff8
- SSDEEP 1536:W7ZppAp55L4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4Ddf:6pWp55qWHIjN3tj6qnv0b2UrXkbvLR
- MD5 SHA1 SHA512 SSDEEP