Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 07:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe
- Size 76KB
- Sample240614-hw41satbkn
- SHA256 1736984c479d951c6b1be35cea5e991e9a15978bb90a7e3adac5202129647cd4
- MD5 ab671f13e996602de9e77edeb977c8d0
- SHA1 cf713511da7eb98044fcb3e12dec774afb9b142b
- SHA512 e78c245595df64cb60e4ae5ebaf128633f6ae4ff0eb386631b2ed814a6035e0545594f0559f3b9a127d61cd4926847ef1f110c071c8624d0aab1d4073b756397
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh3:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsO
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5278) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-180.png.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\msdasqlr.dll.mui.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\desktop.ini.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ul-oob.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationFramework.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-phn.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-pl.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\EnableAdd.mov.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-pl.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationCore.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\ReachFramework.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.AccessControl.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Parallel.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\t2k.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp140.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\WindowsBase.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Primitives.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\lib\dt.jar.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.boot.tree.dat.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-processthreads-l1-1-1.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-pl.xrm-ms.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuuc53_64.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.AccessControl.dll.tmp ab671f13e996602de9e77edeb977c8d0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
- Size 76KB
- SHA256 5537d104148949717eaa8ea611eadac41abdcc8a106e77eca6d094673dfb83c0
- MD5 a7fa4c6af5f81aa220cf004a85aa0f9f
- SHA1 e69f687a4c171e245699256a5c1c0939d03f65f4
- SHA512 c24ebd0e2c9b82897b9e9f400359538c914a98e9985198ffb5fd9bec248922b7dbc099e73e4bd2350bf1d992d8682c1ddb590a7f918cd2f3b0ad59cf4e6c7498
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh1:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 175KB
- SHA256 054105c2b57b37937b9c404c9c7f820d03b0268e4b1cd42eefa05d69cc47070d
- MD5 0b836e403ba71b175c5801622e812a74
- SHA1 4270cd1636f124f7aae40abfb25904ee268a5690
- SHA512 6a73010a22fdae56a41614918bb5041e6acc1c84955cd646babef0b1d31df7a413c71ae326c6963f6bff4025bf6c18334424129e9713cf7c8d06088d79e80ad6
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBF:PqFF2Ie+eF8IjNDv0bNXkbvLK
- MD5 SHA1 SHA512 SSDEEP