Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    14-06-2024 03:50

General

  • Target

    9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe

  • Size

    74KB

  • MD5

    9ff6db7f6c65781f7bf852cc779ba800

  • SHA1

    7d9a1c2c23e9a7f225683e96adefceb594339fa2

  • SHA256

    ce0fb52106c19f407d25f55ae22e1e670eb534fa937b2385d91a5013e599aba1

  • SHA512

    8212012652142c5db8982dd9e8d74c7d138779c691c6db6216c40aa97d1a23260d1f5679be414dca3ba8cd68355dcfc589d1b2e709940517eabaee34c983d070

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhO:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsT

Score
9/10

Malware Config

Signatures

  • Renames multiple (3686) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
    Filesize

    75KB

    MD5

    d5cdd1210d01a12c833ad431e82db3fb

    SHA1

    9b4e0b2e97b6861752b97855e5ec8545b845d645

    SHA256

    ecc34c726cfab86b0c78da1566472b7d076b3125230e4655b3fa4bbf0c248060

    SHA512

    03d45bfe91eb638900aa70771e308987162a519cb86c84aa6848a4e059494ac649e7d591bf4c6d383a11470808c66192081692899961cc2806c79e46a910133f

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
    Filesize

    84KB

    MD5

    0f8c35fcad9f52ee968474bcd2dbb915

    SHA1

    a1a79142ee1b15e57c57eccc7171df08d55d6297

    SHA256

    fb39e5f8c0be998363a35156e768043d674ddd711dbb6d9dd7bb134ed4163199

    SHA512

    325278d0bfed5e875257f133c9ab69f6ed702fd685cbb07645ee07f9e3c4bed8bf91f3aabccb724043512ffc322a2ab6758c77953a55bbed08477c15f50a1f7a