Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe
- Size 46KB
- Sample240614-c2hf3ssclb
- SHA256 f42318e3912ddb6b869e055f52bc28be00825cb88fe66fad966860405a84f749
- MD5 9b881431deef275b0f8039645f269e20
- SHA1 4ea0a2056e0219c9768ed3d12fb562d4c5334019
- SHA512 e53aed6ffe5886c684d8dafd762a7374e35a9ee36d5ab6710f4e5a9ec1fc6dc4e7d91b9f0f3254e8e1281772c908d18885174d252d371a71618922beae827e3c
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNO:W7BlpppARFbhWJQig
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5358) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\directshow.md.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\charsets.jar.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ppd.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\msipc.dll.mui.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ppd.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\sound.properties.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as80.xsl.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Extensions.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\images\bing.ico.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul-oob.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\DATATRANSFORMERWRAPPER.DLL.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.XLS.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Controls.Ribbon.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationProvider.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sq.txt.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Grace-ul-oob.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Xaml.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ppd.xrm-ms.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp 9b881431deef275b0f8039645f269e20_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
- Size 46KB
- SHA256 d7fd5034902c9b6b2622209b4a4b43838c223f4151796fa0db6297c99ad6e72b
- MD5 d3cdd743f4b4164bb41e78f77c320fa4
- SHA1 cdae782a4999df9d753f78c83b18ac3024e6f71a
- SHA512 56704060bb4e76bbd2c550c01bd50080b135da7242ec02893e658350a5ffd4fbe3f084625883bdd403519587a845ad0d0e492cb2f27325168472b38e11e05eb3
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbN7:W7BlpppARFbhWJQi1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 145KB
- SHA256 b7443fac7361747a83e116e2f3858fef8c678cec8b6fa184d6e1380838447626
- MD5 4132d6b3582f796b5186dff660dcf2a4
- SHA1 40b62889964d287f8855cb354b235d26346230ef
- SHA512 ff0cfd3d9080d68ebfd088b822f9e62f00aca89807d0646d236d19df72b07fb5e87b815c3fdab5a98ce10ed3945f01266a2e581885c3806925f96f7a0a1dd53b
- SSDEEP 1536:W7ZppApHi+4pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYf4DdL:6pWpHi1WHIjN3tj6qnv0b2UrXkbvLd
- MD5 SHA1 SHA512 SSDEEP