Analysis
- max time kernel
150s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:01
Behavioral task
behavioral1
Sample
957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe
- Size 98KB
- Sample240614-bdpd2syele
- SHA256 3fdbe45b9d81689d2f073d2a60bf923e8391c6be175f235dc447272285bf40bd
- MD5 957b5c7c70d679a944da7cedc610b940
- SHA1 fa9cb95ae6c94000bcce6e14b3e967ede81f4ab4
- SHA512 d68acfff7c4969734ff0419e97527ce0bdb7cb460d4ae39f8fdb2616ca982518ecd0127e226ace0274cffdbef682fa1049501727dd810438e7b3c46edacb4b15
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulw:enaym3AIuZAIuyxJrQulw
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4905) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/4400-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023559-2.dat upx behavioral2/files/0x0008000000022aad-6.dat upx behavioral2/memory/4400-1780-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.CodeDom.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN107.XML.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\COPYRIGHT.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glow Edge.eftx.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\FOLDER.ICO.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-100.png.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatching.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.FuzzyMatchingCommon.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\zipfs.jar.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL054.XML.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Common.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-oob.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msotelemetry.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pa-in.txt.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l2-1-0.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\gu.txt.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.DataSetExtensions.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\ir.idl.tmp 957b5c7c70d679a944da7cedc610b940_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp
- Size 98KB
- SHA256 b1910261d6a168a73caa5b4f7ecd6a3b8d54946d817b04bb2298520d82fe9dab
- MD5 25499f40a3d62d3f70af3045037506cb
- SHA1 a24db46ec4313f4e9524a0c097eade040847c26c
- SHA512 3f7cde8a3ac8447aadc363f870db1ce0bb3fd138a29ca0f0b8f1bd479e3d400f01ecb60f946fad6a75f270dc0bcd9618fcc16086b50bf4df08d763b18fb0bfb1
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulJ:enaym3AIuZAIuyxJrQulJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 197KB
- SHA256 fe84532f9463847284ce91f1992e8a62f207b2c8e1844771678bf6bdd35740b1
- MD5 2b7d5dd1613d4113dc648a25d19f58fb
- SHA1 fc854113947fae4680532017838f1058533daf7e
- SHA512 687ab5766534d0c31265ddf2dafecbcf5630df098d08efabc823729df419a42c112a9a65094e8ab9ddde519e3b96afc9ec9f7f0d338741fffd6c530b79c12ed5
- SSDEEP 3072:enaym3AIuZAIuyxJrQulrWHIjN3tj6qnv0b2UrXkbvLV:wHm3AIuZAIuyxJr2IjNDv0bNXkbvLV
- MD5 SHA1 SHA512 SSDEEP