Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe
- Size 78KB
- Sample240614-eq86rsvbrd
- SHA256 a071f8c717d3992f1752ccba135a5c9a7b44934cede86da59cb455985bbe7b08
- MD5 a125686b9a379c4e5bf3242aa82b1910
- SHA1 a5a5392b2e1070eea983e7522b89031e5cef3b0a
- SHA512 8805663230613a0155c10b65690f75c69c39e06d8c20bf1947d07ddc0595baa66ce902fd6de4a312574a931e0eafb8688085dc6a5fecb60391d8acd825b3262e
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhR:6pWpUFpEhLfyBtPf50FWkFpPDze/qFso
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5006) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\fur.txt.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.White.png.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Primitives.resources.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ppd.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ta.txt.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.Core.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PPRESOURCES.DLL.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NameResolution.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Classic.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\cy.txt.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsBase.resources.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\lcms.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140_2.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\office.core.operational.js.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Excel.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.ReportingServices.AdHoc.Excel.Client.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ppd.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_upe_sdk.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Transactions.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXC.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.Design.resources.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL120.XML.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN102.XML.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\WindowsBase.resources.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.cpl.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifestLoc.16.en-us.xml.tmp a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a125686b9a379c4e5bf3242aa82b1910_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4308
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,1400471177590024469,587385956640537806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵PID:3400
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp
- Size 79KB
- SHA256 05cf8e3dc49bd83cc46d244dd78f0e44312deb363eb1aee002c02a87a6e140a5
- MD5 43d642b6ff2ed4cc0176d884e890f101
- SHA1 80d6015f93dcb8c555f2c64ae24ff3351d817675
- SHA512 7a1c3de434d00b22844211ed670342147097f775c67cb265cbecf4392ddabf85e3cb5b1261807df767e1a27985130757922a39e4a1f2e6a1bdf158dd763bb065
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhC:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 191KB
- SHA256 1ec01f15c120c7a391e9e93d3633510d74433a1876c568028d8c0da03e47322b
- MD5 f603a768cee773aff116a3322e21e32e
- SHA1 3f81a3e1a18d44f2edf47a8339a8ff6d5c93b303
- SHA512 f266f76116acc71b9f6d0841a72e11874865cdcc579b0f6f3c031d602209921867046803eff1bc5d40e8d717d91d0469d7f959675f232e09ec040e6e1a77172a
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBw:PqFF2Ie+eFaJ3a3LXGZkUcTb1JcrjQ40
- MD5 SHA1 SHA512 SSDEEP