Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:38
Behavioral task
behavioral1
Sample
a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe
- Size 59KB
- Sample240614-e9mrwayhpk
- SHA256 38c90b5c222b349e8753d1ee507fd48148a28f2c477f9435eb73e1d24f47ead6
- MD5 a2b492ef3a3f031167edb0884ce4eae0
- SHA1 f2e81258a1446059c802b05a79253031260ffe9a
- SHA512 3365b1e006b355b03290df1da5f227f19faef3227ac13ae2be3a1719c3b2886304f8eb19f5354b0c6624d0c1f1bceebbe1fe50b97fad48a33f3437962cfeede2
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOhLS:KQSohsUsyLS
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral2/memory/1820-0-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/files/0x0005000000023276-2.dat upx behavioral2/files/0x0009000000022975-6.dat upx behavioral2/memory/1820-1210-0x0000000000400000-0x000000000040A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemData.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OSFSHARED.DLL.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.EXCEL.16.1033.hxn.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\sunjce_provider.jar.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clretwrc.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN022.XML.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\UIAutomationClient.resources.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Thread.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Extensions.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sunec.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\msvcp140.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Controls.Ribbon.resources.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Extensions.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ul-oob.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\pkeyconfig-office.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ul-oob.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONDIRECTX.DLL.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART15.BDR.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-pl.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_SubTest-pl.xrm-ms.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif.tmp a2b492ef3a3f031167edb0884ce4eae0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
- Size 59KB
- SHA256 2400415a6d8d72e18cd98d3fcf2fc8a418cb2ff597481fd030365ef95500ba3d
- MD5 1352f627b72ab519008fdc123bf364cf
- SHA1 25a3615dd64dc74daea870d49b7f0c7378561cf3
- SHA512 fdb533417eba5d721ff9a0aa09dc89e9051f6a4d702501cbc1081b260186f106ecb3aed1af2383c534a908c3d34c34fc400c40604e6fb8ab61401172f383a867
- SSDEEP 1536:CTWn1++PJHJXA/OsIZfzc3/Q8asUsJOhLF:KQSohsUsyLF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 158KB
- SHA256 e9215b4c9f55dfe9b4ca12a1c0a87c7df9f5842d9d169feab063a46a14f5afeb
- MD5 96d6109a1fdaa694fa4f9c410461f914
- SHA1 4759bfce5d68b07b8348153bce0eb5bbd4c984c8
- SHA512 b6be0d196ac365e509ce344daf2d6c9e73c883a64ad26d2955ca0aa5a2e4b1bd3faa5862d36f9d99ced13413615a0954fc6b5135cf19374c60474589b182d453
- SSDEEP 3072:KQSohsUsyLNWHIjN3tj6qnv0b2UrXkbvLh:KQSohsUsyLKIjNDv0bNXkbvLh
- MD5 SHA1 SHA512 SSDEEP