Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 23:38
Static task
static1
Behavioral task
behavioral1
Sample
c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe
-
Size
44KB
-
MD5
c31e33ad3209df3336cc48f326d0d5c0
-
SHA1
70638beed14f7e08f12f41aac5259b840c831c5d
-
SHA256
47871149450625526eaec39bf6a72e72cde531d96ef75c6e104fefcdb2409e34
-
SHA512
cbc6ec55b6d476ab8a81f7ebdcf219ae5d140104475393031181c053e1402f5ca46e89275cd8ae82a22b832284200c2a1d85c77ea85f14d78688ae17fc5a69b6
-
SSDEEP
384:GBt7Br5xjLMuLAgA71FbhvDl3DG71ul3DG71XUmUIYFt1zecDT1zecDY:W7BlpNLpARFbhblkYlkuvIYFWcDYcDY
Malware Config
Signatures
-
Renames multiple (5325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\wab32res.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClientSideProviders.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription3-ppd.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_ghost_company.png.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Presentation.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-pl.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONBttnOL.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\PresentationFramework.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-140.png.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\dnsns.jar.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Primitives.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\management\management.properties.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationTypes.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ppd.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Primitives.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Channels.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-process-l1-1-0.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.AppContext.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Primitives.resources.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lv\msipc.dll.mui.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.DataContractSerialization.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ul-oob.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7FR.LEX.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_MAK-ppd.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-pl.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\hostpolicy.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Inset.eftx.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\IGX.DLL.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.DLL.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\fi.pak.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.tmp c31e33ad3209df3336cc48f326d0d5c0_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5e4b723543cf9be885d5addae74d7478e
SHA14c1b80478c8a8f51114092120255a794992e61fd
SHA2568a425daaeca5a06277888063944210bbc5f355af422692f2d16d74948affb158
SHA5126e9074cb90aec05b21ff6e121293c9e14aa8ddc5eee0b28b70c128f7d6e1022fd41a5e81b479eed9651c67333f0d69a4eb04dc391d07837af2365f77ad7d7a14
-
Filesize
143KB
MD50a635c0a65444f4a69acd39e8340c6cf
SHA13e90682887918bbc6fb87a1ad58c7b1ce1f63075
SHA2563b5228327559671f60846e827e1541fd57c4e3da8e4be04b201fa0b44ccdc195
SHA512355da2ffb80502f845233484797a73a88c09d705d6d35fe72355e2bb7832dd80edde05ebe619a73f474822f129dbd322233d5c74f5777fbbd4992f1e07af14a0