7af5f739a9897bca404d5f4db7519fd3aeb68cadb1e603abe6e752d4b4ebc0ff

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
Size 78KB
Sample240614-e2qtkayfqn
SHA256 7af5f739a9897bca404d5f4db7519fd3aeb68cadb1e603abe6e752d4b4ebc0ff
MD5 a207db795798d6d8a68f537d8f7b1b20
SHA1 f8664d69ab06f8d5fb0bea338deab1bd82b49bd4
SHA512 ab6cb4c1f01685414e8b2e8c1036e372d7ffa14edbd26a2d247cadb0e1f3dddf229547b63762c949b86ec2bca38749b5c1d952183e9afd14f16fd8d79374a3ad
SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHp:W7ZDpApYbWjIlE77ufL2e+efZwZ2b
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\PresentationCore.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jpeg.md.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\InstallProtect.vbs.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fa.pak.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ppd.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MSUIGHUR.TTF.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ul-oob.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\prism_d3d.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\WIND.WAV.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEV.DLL.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\glib-lite.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\centered.dotx.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-pl.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.OpenSsl.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\ecc.md.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClientSideProviders.resources.dll.tmp	a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a207db795798d6d8a68f537d8f7b1b20_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4104,i,10373433614523925616,13586256558317053467,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
1⤵
PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp
Size 78KB
SHA256 20695803f40aa0756ffef37a008a56c8557197aa4dd4e255db6e97e0d6e3c4d4
MD5 5b91964be2ca76be1b723590a65e8fd7
SHA1 6cf5e2e78af9287153e4abe7ff143bf7a3994ef9
SHA512 1bc88e6536a2044af1302972e9c0df48570eb42b53e139dabe7bf7971e2fab831c85f991b493d4d01512c8273daf0c7edbf24a1ba5425018c5c06638767e3b76
SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHW:W7ZDpApYbWjIlE77ufL2e+efZwZ2w
MD5 SHA1 SHA512 SSDEEP

Submit Download

7-zip.chm.tmp

Path C:\Program Files\7-Zip\7-zip.chm.tmp
Size 190KB
SHA256 df372f06a982a1c08c2fd6396ce3a4fbc0f7ca4265b5425d95866e81fd63c42c
MD5 2d4f8773e7ec1ff75f052dcc3dd354d3
SHA1 9689f685d012c089d581bfb3eaef151816dec704
SHA512 0b855eed0721171b64678cfe35a5c5069994853690ea61160432e76ba9557e89939d3de3ef70e12064d04a41ae02245985b2e9383b540f92079708cea04df111
SSDEEP 3072:6DWpwE7oL2e+efZwZNJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4RPi:dN/e+efiLJ3a3LXGZkUcTb1JcrjQ4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads