e881f8a391e2747ed4b396c9b534eb86af827839b66259b4a0572acbf9aeb872

Analysis

max time kernel
152s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
Size 46KB
Sample240614-jndpas1bqa
SHA256 e881f8a391e2747ed4b396c9b534eb86af827839b66259b4a0572acbf9aeb872
MD5 ae51373c9588ad5c391a9b27ef8c5a10
SHA1 c069ed89a381f88060399aed177fbff427f507bb
SHA512 cdfd657dce372d987cdb93164f4fdef210eb43658a703251800a35e22c315f4476b10d66815fbb3c45e6f033295ff0beb601aae224e97d93e7f9415bcb2c51c2
SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbN7:W7BlpppARFbhWJQiZ
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1055) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\PresentationFramework.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationUI.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadco.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\DisableAdd.sys.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.deps.json.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Xml.Linq.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Reader.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\D3DCompiler_47_cor3.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.Primitives.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\PresentationCore.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClientSideProviders.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Primitives.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.ILGeneration.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Mail.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.Compression.ZipFile.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\ReachFramework.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClient.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.Win32.Primitives.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Emit.Lightweight.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.Ping.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Numerics.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.WebProxy.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework-SystemDrawing.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOLoader.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ValueTuple.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\clretwrc.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\PresentationCore.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\WindowsBase.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Writer.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.X509Certificates.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Controls.Ribbon.resources.dll.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae51373c9588ad5c391a9b27ef8c5a10_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1352 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:2628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 46KB
SHA256 ffba7de97bc45a274b233ebc2327c6e96b875a10794f519b0d7f85facf3714eb
MD5 b0e01045f98633a6247eade343f8c8de
SHA1 dae497341cb501cca7e4023863f1b4ba793dec46
SHA512 e6eab95d5acace74294865c326f6ae7f3b7fdf5985c65eceaee09ce4fee61fe3d7bb3ad28e4a8ff433d0e16905bf7b13c78741d641312178cbe2532d980bf821
SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNe:W7BlpppARFbhWJQiE
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 46KB
SHA256 70ad5dbfac2767f3ae4edf586c7c8cb78cd373580e2f397d1da6a1f341d18a33
MD5 8a3a123cf4d24e8d2aabc6fc612b36ba
SHA1 34fdeb74323e56d6a05c8ffd99ae64689b8bd05c
SHA512 1b37b4c0793f5b9f391cd0b98b2650e6a4af2f8490b7e2233779ac4b2145b716b7b6733c1cbec5329295d88732d07c655d4ae0e0525154580ffc5249a231aa90
SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNt:W7BlpppARFbhWJQiX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads