Analysis
- max time kernel
149s - max time network
57s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 05:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe
- Size 75KB
- Sample240614-gaxtxa1bkr
- SHA256 26daabf13a26c618318ef76b469e32cc9cba2d026066d29ff2309599781c03f5
- MD5 a6609e8cf9896112ecf25d3e7197e350
- SHA1 c2f7363853e2a58c604277a8620e0791fe4eb6e5
- SHA512 2f637be051e0505d6849ac324dad9f2eb340612487688e3522ed8681e337ca5c427a42e8e6af5ac0bcc37cf85fbde6ee3088705a9cd5ba4ab9ff9bbbbbd77dce
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHF:W7ZDpApYbWjIlE77ufL2e+efZwZ23
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-80.png.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationTypes.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationUI.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\PersonalMonthlyBudget.xltx.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.Lightweight.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationFramework.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-ul-phn.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Intrinsics.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Primitives.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.V7.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Primitives.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsBase.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationProvider.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\WindowsFormsIntegration.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ul-phn.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ul-oob.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationClientSideProviders.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationCore.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\sspi_bridge.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-pl.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ARIALNBI.TTF.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp a6609e8cf9896112ecf25d3e7197e350_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
- Size 75KB
- SHA256 cfbdaf4220d43163c042aa526800d4b8a966f80d591b68835d24060b357cc87a
- MD5 81a220dbfba84a25bd6ae61d367c2f4f
- SHA1 5b23a27cc4350561654e6092d327c84feefac518
- SHA512 ee1b574f18327cf71e1b539e93c7f6502ecda6ce7c729336a5e8099fc00fd9d60759d72050e38d72c988bada9b18d9c73c35a3a355067cf62eaf833275f084f4
- SSDEEP 768:W7BlpDpARFbhYQkQjjI6OvSox/6Sox/hotyuftxtjYJIJDYJIJPwF9hHMZIa9hHY:W7ZDpApYbWjIlE77ufL2e+efZwZ2a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 174KB
- SHA256 152e53cbda450dd6a7f9e9cadf89087d742ddfbbedafe11d074e8b4f52a579ec
- MD5 1d70d5e4d6eb4527f6ef995c4d40c4b8
- SHA1 131e40c35bd460aa0373184a51ca9832deaa5070
- SHA512 730a31af8552e3f6f37b9eab347426fd43803b33e944e7b51a6d938afcc8715791a060f6bc62b2e561b79e2befe3c9592b4cbdbcd8a44bb7c608c4d363a6073c
- SSDEEP 3072:6DWpwE7oL2e+efZwZJWHIjN3tj6qnv0b2UrXkbvLq:dN/e+efiQIjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP