Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
16/06/2024, 02:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe
- Size 42KB
- Sample240616-clncdsygln
- SHA256 a10c615405e2988e2a0527f1ef1bcf976ec120b87c1a2f45eb03f7f7fc4d7e22
- MD5 cc73425eaaaaeda63600077671b4c950
- SHA1 ff365da31d2c036e1f2f5a5a6675f5c95d74ce6d
- SHA512 f699be5175401c5542a68e6c1e4958306aef29a015746016227d7c9d9a3815adacc20cdc57b4bed1f1201ad58eee715108fab313d19e87430498259a8b369307
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrm2JguV2JguD:W7BlpppARFbhWJ2JgjJg8
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5108) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebSockets.Client.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\OMICAUTINTL.DLL.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7FR.LEX.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\WindowsFormsIntegration.resources.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.Brotli.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.AeroLite.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Models.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\dcpr.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL075.XML.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\JoinAssert.pub.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-100.png.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Forms.Design.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-stdio-l1-1-0.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\EntityDataHandler.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\msoutilstat.etw.man.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-TW.pak.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Dallas.OAuthClient.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-warning.png.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ps.txt.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-oob.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\SmallLogoBeta.png.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-pl.xrm-ms.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.dll.tmp cc73425eaaaaeda63600077671b4c950_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp
- Size 42KB
- SHA256 0fe159618e9d5c6fc253e4b71c6957db0df8ff4854d2688935538128941c40a9
- MD5 6d42d43ca71e5bd98d346b935bc552f6
- SHA1 77d482e17bb884dc4a7b4b6904f3bb0b01c4b463
- SHA512 310fa34052607a9d433fce12c92599cf01cab0426333c48b62ad6e0f2b8d75333fde7c81d03f21b5f790242eb8e4fb7aadfb49268ea943c4b758daf300f02286
- SSDEEP 384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrm2JguV2Jguh:W7BlpppARFbhWJ2JgjJgq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 141KB
- SHA256 ce35567a118d3636c1e38d31bad9a4b37ba82a68c14d61b44f3cdd763a6028ab
- MD5 569c030f6b99e1e82134ec898b5dbb75
- SHA1 1d1dba21200b22e2524ea9959c259bcfedfc7b9f
- SHA512 e14186d3e1bdc8e373588a8ffd3d695da22056d1e4b5fbe0dbe906f7c613140ed448971ada5e57d558dddb9a882ef7849967eb66049fb9f3e90711a24cf5f2b9
- SSDEEP 1536:W7ZppApvJgjJg94pWHlPEXZzjUq3th5f6utM5vLNinVmWvMu0b2UdpXk+p0RpYfW:6pWp6WHIjN3tj6qnv0b2UrXkbvLJ
- MD5 SHA1 SHA512 SSDEEP