7e60048825e16f6748ecd4ef4609046368f5386397fe3b1ca0f07cbf348756af

Analysis

max time kernel
156s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
Size 50KB
Sample240614-jrdhps1dma
SHA256 7e60048825e16f6748ecd4ef4609046368f5386397fe3b1ca0f07cbf348756af
MD5 ae9bbd997829f6d42421ae128f7c7c00
SHA1 6e19a9d56f3c48fbb1279836a1972ec6fb3217ee
SHA512 a2cae54428f407f46d6124e322c8a9e871b4a98707bf43930769cbd53e05134dc9f0708292908fbbe965c3efc644da134484c66591be7ca2687d99f5bb4dad29
SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNl1D+1DZ:W7BlpppARFbhWJQitAN
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1137) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Resources.ResourceManager.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClient.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Immutable.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.DataAnnotations.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Linq.Queryable.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationProvider.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado26.tlb.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado27.tlb.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsBase.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Core.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\Microsoft.CSharp.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationClientSideProviders.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Windows.Forms.Design.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\UIAutomationProvider.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\D3DCompiler_47_cor3.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\System.Windows.Forms.Design.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\ReachFramework.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.Xml.Linq.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Numerics.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.DiagnosticSource.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Loader.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlSerializer.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msado20.tlb.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationClient.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Xaml.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\ReachFramework.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-string-l1-1-0.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Data.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Controls.Ribbon.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\PresentationFramework.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordbi.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Globalization.Calendars.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\WindowsFormsIntegration.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-string-l1-1-0.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\WindowsFormsIntegration.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.Extensions.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\WindowsBase.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Luna.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml.tmp	ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ae9bbd997829f6d42421ae128f7c7c00_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:8
1⤵
PID:1532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.tmp

Path C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Size 50KB
SHA256 693b76dc145f837d3aa94847d8816e1e06ef74a17b4e2876d2df8a7603929590
MD5 281a6fc596572ae4ebd14507d14eea19
SHA1 43580003fb1b0e8d06963e2dc46bea303d8edd4c
SHA512 c30fadea8206802bf8d4be39ed647d9f28257e0261269ecc5d3e43f6f6f51dc1e405007fe7f9b648e16eafe028e32f8d146890d121bd23f1594de1e4ccc07ac5
SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNl1D+1DS:W7BlpppARFbhWJQitA2
MD5 SHA1 SHA512 SSDEEP

Submit Download

libsmartscreen.dll.tmp

Path C:\libsmartscreen.dll.tmp
Size 50KB
SHA256 24910cbd45f37976b9d49302d986ef909fd63df4740444a36e7422b289691c69
MD5 b0dffbc67a97bb1680dfd8e9b7ae91cc
SHA1 5077c1e22e38040ae291bad9b754a796259824a9
SHA512 84b0c33e42c2aea4794b5abc6c0e422cba01d898bca7b45f75c637020ce3774602db1ce8a10a5863be1c14798cf70464bfa6a2529fdb56d81df7e3531b94b349
SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrxxbNgbNl1D+1DX:W7BlpppARFbhWJQitAz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads