Analysis
-
max time kernel
150s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 02:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe
-
Size
80KB
-
MD5
cd41996d8fc4763384c08ea5acf3e260
-
SHA1
03e70d72bb8a9f2523c1a8976c33e03500d84c1f
-
SHA256
d319534f97396915e13c9944e71dd422265c4f2c7c53277e3a73640d96e789e0
-
SHA512
90d1876788260dfb8561ccd4b05d789385497f26dcd34839728a31493737430e1c61478497b67f0679c9df38fcc9f82a552418ce3c8ac8c1b399ef7e05232d08
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/HfFpsJOfFpsJ8:6e7WpMaxeb0CYJ97lEYNR73e+eKZHfFl
Score
9/10
Malware Config
Signatures
-
Renames multiple (5130) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryNewsletter.dotx.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Controls.Ribbon.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCONTROL.DLL.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\index.win32.bundle.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\BillingStatement.xltx.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Xml.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT.HXS.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-100.png.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-phn.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\security\javaws.policy.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.DataIntegration.TransformDataByExample.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Controls.Ribbon.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AuthoredExtensions.16.xml.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClientSideProviders.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsFormsIntegration.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\vcruntime140.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-80.png.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ul-oob.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\PROCDB.XLAM.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.DispatchProxy.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Input.Manipulations.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Input.Manipulations.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat.tmp cd41996d8fc4763384c08ea5acf3e260_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5948d4a3c97b95fcca3c1fb14321c5d81
SHA18412346d207f4fcb216fcaede29aab17dbf37e8a
SHA2567e74a5835aec864a31e3da77fe605f42754717bdacb4171c0327b3b0bccf26c3
SHA512b063b3fdd114a7e6344846562f3b217f1475a6ea0883730854a041f37521f9870a805f45cfde50a7e0e01025094b475c39e27eb3f78611231422cad9233e4b4c
-
Filesize
179KB
MD5bfa3bfe7d5818416d883de8b295cc42c
SHA199b1714a612b2076de5105ad09cea448e8fb81d7
SHA256b978ed53a6816b07e1e0d9044da07bf5b8fee10e337250e29531ab96ecd9b242
SHA5125f0ccd7002a662596c7531f2b2422f946a62bd5df1f412a5c35f3554d8c7f7d286e8740189176e5e5e0e665504abb4be1ed7a8e561bf60a1403a030019738a3f