Analysis
- max time kernel
150s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
- Size 79KB
- Sample240614-eqpgcsycrp
- SHA256 7b76219711e1c48550ba4fc5cd995cf353ca6aab28e7f81ce88303a229acd47a
- MD5 a118bbcd44222d7e2d707a598e68fc40
- SHA1 01ea9bc9ce6b1b7bb8969f5c381beb1d8aae436c
- SHA512 c90956f461c5acc5f8bcfde39f6e5bdafb390037bdc9822d4ba83dc8631c96b05c91bcc7b9b460841e5be4c562e93caf22b8c718021c1d2a785b6d1886bdac27
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tw0A0v:6e7WpP9oVLQthbYY9oVLQthbUrt7tw0j
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\wab32res.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\zlib.md.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.Reporting.Common.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\UIAutomationProvider.resources.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\content-types.properties.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.AddinTelemetry.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msader15.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationNative_cor3.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\javafx\jpeg_fx.md.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-phn.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\mesa3d.md.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\resources.jar.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\PresentationUI.resources.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ppd.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EntityPickerIntl.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Contracts.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.resources.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ul-phn.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-phn.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sk.pak.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sawindbg.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ast.txt.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Forms.Primitives.resources.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-handle-l1-1-0.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\manifest.json.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-1-0.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.XmlSerializers.dll.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a118bbcd44222d7e2d707a598e68fc40_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:4572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1416,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:81⤵PID:236
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp
- Size 79KB
- SHA256 7e0c98dc61f7df25570db7dac8561c20d17298b77fa8a891136b4ed0968c87d3
- MD5 120959c1137f51bfcd8ef1cf7e99b99f
- SHA1 62d7a63593467c1fb51f3ef775e97ca27f4d7a47
- SHA512 aacdb3626c13c23c9d08e8338a63b145988db202005cd39794655a918c80106fe6f9f7743c36a6edb799e5e2597d1a2653e3d1ba56e83c8df4dd2d946a6f436d
- SSDEEP 1536:W7ZhA7pApH1d9oVLQthbqbY9oVLQthbq51Rn6wt7tw0A0w:6e7WpP9oVLQthbYY9oVLQthbUrt7tw0k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.chm.tmp
- Size 192KB
- SHA256 5b346512ef149c06c5cc863da68e43b5ef36a04d1b54c9f45699ad00b0a4026a
- MD5 debf9e9f558a1a821c23e12d5d640356
- SHA1 eb1d22384572b460c8dd5cc08bf9fbaa712ad9ca
- SHA512 d50bad9ce4187e46ce9f460d06a688739fa9812038666ecaa20a0dc6aa30e1b0a9a00a9278b6e9f81cbc51fc11e994fb8b3462b8d0c5f7288057c97c28e3cc98
- SSDEEP 3072:6e7WpP9oVLQthbYY9oVLQthbUrt7tw0A0RJ3a3LXGNCD/YFkedcTbvNJcr6O/Q4c:RqANJ3a3LXGZkUcTb1JcrjQ4c
- MD5 SHA1 SHA512 SSDEEP