Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 04:41
Static task
static1
Behavioral task
behavioral1
Sample
a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe
-
Size
44KB
-
MD5
a2dd955e9f14500ae17e7476332e61a0
-
SHA1
eb78da914282ccff3c8503d9ea6c833ede975525
-
SHA256
02c08dca00a93be13c68b3dd0f769fa8abae118ed06627a1f4c459da0b8fa2c6
-
SHA512
ed50f9a7393b86467404693d64f19acced1e677755ed7b001706a518827d54589ab154c0529feccefb482251a6841442c40a24b8487405728408701b93cedb97
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDu:W7BlpNLpARFbhblkYlkuvIYFWcDYcDu
Malware Config
Signatures
-
Renames multiple (5326) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exedescription ioc process File created C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange Red.xml.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ppd.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BIPLAT.DLL.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_terms_dict.txt.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Office 2007 - 2010.eftx.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\VCRUNTIME140_APP.DLL.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\mip_telemetry.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\pt.txt.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXC.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Primitives.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightRegular.ttf.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msador28.tlb.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\C2R64.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.ServicePoint.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.VisualBasic.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\msipc.dll.mui.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-phn.xrm-ms.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationCore.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationFramework.resources.dll.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\giflib.md.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2dd955e9f14500ae17e7476332e61a0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4232,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmpFilesize
45KB
MD5404d1471841c7b7ede7ba526fb48a25f
SHA1e9d53e49a86f3ee67d5b65f5cebe593ce8d05034
SHA256d17259aad0f02afa734432b02acaa965747f4432c9da4647ee2fde86ccc2f09a
SHA512f410d6b604cb8f73ecfbc9d2ed034f888a2ce81ad2511ca550f13d00f79b16a64b3edf38a7d44f97cba7963b43587f13fc13c8ccc6b14c94b67641ab3a84a993
-
C:\Program Files\7-Zip\7-zip.chm.tmpFilesize
157KB
MD597e69308ec479e34596d68d9c9d20e06
SHA12965088bea301281ad24b52e1c51ad2781073a66
SHA256185a217188c06c8e93aa63ce24d0958d9b8cd61371266c7b5d0f7c66aa74f4a7
SHA5120b8b6681835488c279e582d37f89f37ccb4246ae45479ece70758710a5caac0a1922002e2e9f2284c761c685104bbd84bb3747e6f9f302cd7897eb0db8f64e84