Analysis
- max time kernel
149s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe
- Size 106KB
- Sample240617-bqvrlaxfpf
- SHA256 da4126481467711b35612f8f6753ab18d14c32eb59096e904c51ba220dd88b9c
- MD5 2cdc1b226c3e07537c2b75f386374d00
- SHA1 1b0222a6e0601b69203c5f607cb0eb0758a0de52
- SHA512 14f55e909c01f4c5c060c42fb510e8ceab093077cc4b48f691acec78b06f5e457e93e0d3b713b5992ced95c722d7b0707206c7a8bc36332e1e97e2dd5db2e1f9
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEXYvHYvT:tFPxPke+eIXSHST
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4669) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\psfontj2d.properties.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.Primitives.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ky.txt.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Windows.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Glossy.eftx.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ul-oob.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Transactions.Local.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019DemoR_BypassTrial180-ul-oob.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Forms.Design.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCOMMON.DLL.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Trial-pl.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Quic.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationFramework.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_COL.HXC.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Resources.Extensions.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\attach.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jsoundds.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Dataflow.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART6.BDR.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail3-ppd.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationTypes.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp 2cdc1b226c3e07537c2b75f386374d00_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.tmp
- Size 107KB
- SHA256 3ebf68aba3b9231ca01893dce6e9b00849006c835a14bd004c053b711d1920d9
- MD5 4a85085363471b29d1a8523891f45517
- SHA1 77ce34b02de33d41a72db344fe1d55cb34a03ad4
- SHA512 2153649927176ca5d0f5df69a8d6359161890c32c9f98d47402ac7dd2c7378e0683f64a4a124401d384aa5eeedddfb0a40ec0d1ec1461c63e0544c10cd85c4d6
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEXYvHYvT:tFPxPke+eIXSHST
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 205KB
- SHA256 5ad40bed548fd41566e97b7d4de10569a1851abd1fe0f86e4c1fcad32e21c626
- MD5 6c740e684196fe11f85d17126b4caaa2
- SHA1 16f5663e5979e13635b1538890a38eb3c2653a0a
- SHA512 9c225235d39cb83ee71c86e1b4c8bda3e2663eca500499f89ea57b482643c61bb83e1d2aa735a9cde8ffe6d20de765a5862b7e6a480ab4d6fdf8aac4de66c010
- SSDEEP 3072:6rWpcOPxPke+e3fFpsJOfFpsJbgEXYvHYvLWHIjN3tj6qnv0b2UrXkbvLJ:tFPxPke+eIXSHS4IjNDv0bNXkbvLJ
- MD5 SHA1 SHA512 SSDEEP