Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    16-06-2024 05:16

General

  • Target

    d872e36f4a3837d8642bc2eb58621230_NeikiAnalytics.exe

  • Size

    61KB

  • MD5

    d872e36f4a3837d8642bc2eb58621230

  • SHA1

    e1cd790cdc1954c56f5030de432185ae7c8816aa

  • SHA256

    117713f60cbe09f7fd4f4ce7f60d91befd0996e30935a4ee84a480406b0bb304

  • SHA512

    28256d6958f78737b2fce32310dd2785f3416b25b0416a54c6b58013673f448e92e63da08a2400a491ac1d2a6b35ea2ac23effeba7dd979478863191a8f57d11

  • SSDEEP

    768:W7BlphA7pARFbhvOsTKnKqtSpFCpF0YSiJgUpFpgFi101tlktRN8kgXZOXcvlkt4:W7ZhA7pApvOsOKjC0YSilpFpfkJOMh

Score
9/10

Malware Config

Signatures

  • Renames multiple (3663) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d872e36f4a3837d8642bc2eb58621230_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\d872e36f4a3837d8642bc2eb58621230_NeikiAnalytics.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

    Filesize

    61KB

    MD5

    e5c4b0f678f7c1ef8da3a1a12c916661

    SHA1

    9e5538eb00c12e6b645588e1409e6d8bae6a66ff

    SHA256

    c532fa8305507d213f3ae483e740b246afdf0a9088aa64527b328b9ac9b1d0d1

    SHA512

    e534a10f22eb7ef8cca1f0337924cb9c5e107c063a3aac44c465303040c4aa6c807515b1134c8cca24bba2a69d21b2875f62f587a374566cadcabc87e3e7f5a3

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

    Filesize

    70KB

    MD5

    b8e1842b28f4561a7636ae23d4aa3424

    SHA1

    449b71987494eaa9267566ef815930c3986b420e

    SHA256

    a690657d08f629b8dc33e75d15e22974e6fbf11458f65eaf5552ed6654ab2a0c

    SHA512

    f8ce0d7de216e328d60339861f447acdd971a7ad0f1c54f712d4df1e3d7f2d5767a8409762b33a61fc4ac98b8cd40e8e9aa609e0a62db9de18326cf774f706dc