527d4649a07cff54b041a8a42c18c32cfb2ff9ec0d7ab5526749d797a66a57eb

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
Size

78KB
MD5

18c985c0914017b9804ed234138428f0
SHA1

8500b96a5aee2757fc5f71f72d59110ba86bd985
SHA256

527d4649a07cff54b041a8a42c18c32cfb2ff9ec0d7ab5526749d797a66a57eb
SHA512

2b255f34117f729fee5cb7ff1dace89849b69a0336ec2f610a5e41b3ef83069e642ba6eeea8e88e60c202bc7aaaa78df54af7c815a453545d6e218ef4eaf2106
SSDEEP

1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhV:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsQ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\jsdt.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Windows.Controls.Ribbon.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\et.pak.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ppd.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSO0127.ACL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.Design.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DIFF_MATCH_PATCH_WIN32.DLL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoCanary.png.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\REFEDIT.DLL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\blacklisted.certs.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsBase.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\UIAutomationClientSideProviders.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\glib.md.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymk.ttf.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\config.xml.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\Logo.png.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsFormsIntegration.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690Nmerical.XSL.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Xaml.resources.dll.tmp	18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18c985c0914017b9804ed234138428f0_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp

Filesize
78KB

MD5
f2cc66d882a6cc19a0ebd67c22bd1661

SHA1
7db38a2765a76db45e9d0d7d3e0f34226a534e14

SHA256
25f6a67c21cd6f42ed562564c0f205d8a796ce4c04edae2fb5d33350e0ba3f3e

SHA512
19387a087713079d3b111b8457ee2f6f38a49b4f30b5e16ad097b6fd562a6760a1f019357353f919f56b48203c3aabaf6ee1fce99c1715b1bfdae389e3206e21

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
177KB

MD5
3a9cb9b1b08d55ad8023f931c89b3da9

SHA1
f8e0d2f6b297b8aead12a423871c156b82eee94e

SHA256
62fa816e9e55c120debc84fdf4bbe859d1c8ec744aab37c95746e7b7ca647103

SHA512
ba58524458c2c749624d52c67fd08e2b12c732b015e9534e4bd0c50b7e61e06aa0b6d21fbe6236d539c4bc3e78168c2405c47030bd3f52d82cd5f599a767e394

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads