Analysis

  • max time kernel
    150s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-06-2024 03:50

General

  • Target

    9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe

  • Size

    74KB

  • MD5

    9ff6db7f6c65781f7bf852cc779ba800

  • SHA1

    7d9a1c2c23e9a7f225683e96adefceb594339fa2

  • SHA256

    ce0fb52106c19f407d25f55ae22e1e670eb534fa937b2385d91a5013e599aba1

  • SHA512

    8212012652142c5db8982dd9e8d74c7d138779c691c6db6216c40aa97d1a23260d1f5679be414dca3ba8cd68355dcfc589d1b2e709940517eabaee34c983d070

  • SSDEEP

    1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhO:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsT

Score
9/10

Malware Config

Signatures

  • Renames multiple (5257) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\9ff6db7f6c65781f7bf852cc779ba800_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
    Filesize

    75KB

    MD5

    e42f507b574d933aae8353c70b133085

    SHA1

    8d077a115d55089878ddb8407b9f24df4c993a14

    SHA256

    bad5e849876fa4770c30de52d1da73515a1f5fbad0efa90046005c7a0a513f32

    SHA512

    28f4bdc1b1429bc1521f91dee8894b53cb8e6b95fc08fd299ad1d99fe456266910373dc815a2e2e3baf913474d90f9ef236a483b6d7cf034bb63139fb2bb879a

  • C:\Program Files\7-Zip\7-zip.dll.tmp
    Filesize

    173KB

    MD5

    0aa071ff00317e21117537c540967d89

    SHA1

    9fead83876d36d9d5d7e316d4380eaaf77dfc6cc

    SHA256

    2eebdf811b0c3231ac8f816b9f0f84930b3d27e6c9688025783230bbde877c7e

    SHA512

    973ae75944e7d0a1ac9bac1822ab464fc2e3889701e86312f63fd54dced2edfb824ddae0b7746ba1f760b03f525bacbcfa5f1a9a855a0d2f88e3ea99a1cc8973