Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe
-
Size
79KB
-
MD5
9d6197fd33d709cf342a114ebf615b10
-
SHA1
d05053046924098d0fd4f064381ab7fe39e44e95
-
SHA256
dd0de9ce91c78b03e8c45b602eeb5233261df2ee6591c0c4138e66e19bae4a86
-
SHA512
1280d49546308574962757ed2c542868607bb80e4ef4b44dff98b09c23dcc4b4518e85c74e4f7a0f42579594a926db0514a167ee9036db091156bfd89e63a73c
-
SSDEEP
1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhw:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs1
Malware Config
Signatures
-
Renames multiple (5249) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exedescription ioc process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.NetworkInformation.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMK.TTF.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\Microsoft.VisualBasic.Forms.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Excel.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Windows.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jsse.jar.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.DiagnosticSource.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\javafx-mx.jar.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.ZipFile.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\msipc.dll.mui.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-pl.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ITCKRIST.TTF.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Encoding.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-phn.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\WindowsBase.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pt-PT.pak.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ul-oob.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-pl.xrm-ms.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ecc.md.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config.tmp 9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9d6197fd33d709cf342a114ebf615b10_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1336,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmpFilesize
80KB
MD5283e661251a568ed96da52feb1787c02
SHA12ab9421dd50fb6f47783aa8f4381f4aee9a47ad0
SHA2564bd36f70df956432319ddd9caa61f11dc7ce5a1791ca4e75fbb1507599a03f49
SHA5128664a98f75a91af9e776eaf9267fde2942741c92e9b64463f8a799b2a8a7c76399c4e631d940d38e39741fbcc25161bfab3ef9612443f320c579ce61b6d76f10
-
C:\Program Files\7-Zip\7-zip.chm.tmpFilesize
192KB
MD55062ced87d97b500a055567d68c3b893
SHA1590a5e613e657f6f9a7cffd534de4437a30ff59a
SHA256a8526cc74f2aba9c14c493c9f1c8b286b4031c8f13ca58aef081a81df306db38
SHA5126a68d30ac5dbbb0ab6b317f3641e13f40621de3b7e6db72dc8b4885b193fdfb37dddd883714087f382cf61398f51570407f55cd26b0980aedfe9cfc59729415e