Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe
- Size 70KB
- Sample240616-c8ec1awfma
- SHA256 c864c48434bb38624cb10e0831ef8cff611f6d5c22efb659493c061d991eb358
- MD5 ce7a5fbe4d0c882457a843dc9f02ea00
- SHA1 7e3fb8e9e890cb10551bc7cb892ae09a18a54057
- SHA512 c8f7808dd73edb8cbb6394e5563dbaedd6af771f57e8c54b8f083f89714d6bd1fc929c53c65105fe77d87b6ed132f4c9a2300c96b2ec9ce489e3b941defae039
- SSDEEP 768:W7BlphA7pARFbhvOsTKnKqtSpFCpF0YSiJgUpFpgFi101tlktRN8kgXZOXcvlktm:W7ZhA7pApvOsOKjC0YSilpFpfkJOMJl
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL121.XML.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Sockets.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\msipc.dll.mui.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ul-oob.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-oob.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\tr.txt.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\msado25.tlb.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Xml.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-phn.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-pl.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.dub.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.AccessControl.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONLNTCOMLIB.DLL.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OsfTaskengine.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsFormsIntegration.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoDev.png.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Integral.thmx.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.WINWORD.16.1033.hxn.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationFramework.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\da.pak.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\awt.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\AssetLibrary.ico.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial-ppd.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\jfr\default.jfc.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp ce7a5fbe4d0c882457a843dc9f02ea00_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
- Size 71KB
- SHA256 3d92ed6ff79f148c4947bc56bc7f5be1c254807f6772de3a33570829661b2be6
- MD5 0f617d46c2d5d2bb0e15fea186f8531f
- SHA1 486c8940ed6d05396ffb7203cad49d122990cd17
- SHA512 4d59184f6bf51595409d0ca439fea9d3af8b073b8f7e937b02432f3b9179083669e75cea97c2fe69c465221c31429c675398d4162af22d545c2d3cab4f87227b
- SSDEEP 768:W7BlphA7pARFbhvOsTKnKqtSpFCpF0YSiJgUpFpgFi101tlktRN8kgXZOXcvlktO:W7ZhA7pApvOsOKjC0YSilpFpfkJOMJx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 169KB
- SHA256 c1002ad529f15fbee8b5a1639b02c49e30d9f1de81ffa162a48c3534031cae5a
- MD5 6cb77b0ab20da50f646b1677cb83d018
- SHA1 2c965b51dd5baf3189f509c5eedd5f65e0418503
- SHA512 9a920e0d8dd9f395d9681ee409e665ba98ccbc95455093321c15caa4486ac564a7ad519dd59e5ce572a92757993195e795700a2074e3d2d4fd894c36c52d0031
- SSDEEP 3072:6e7WpXYvnmWHIjN3tj6qnv0b2UrXkbvLG:RqRShIjNDv0bNXkbvLG
- MD5 SHA1 SHA512 SSDEEP