Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 07:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe
- Size 83KB
- Sample240617-h5msvstflk
- SHA256 f1ffabcebdb71426459ea36a4e3c5cedeea2e8a628281b8af4c10422366baa29
- MD5 60e533b160c4c0a9c6312314b64ea530
- SHA1 2dd59eb787106b7285c5532df115d3abc437dbf1
- SHA512 abb67691996d2d2a359effb09db32d432ee2afe1eeda5fa4212b9ecfef2389b37309da5f9903961b580de23ebb5d234144351bb62daaf753f2ab4de081e00526
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhR:6pWpUFpEhLfyBtPf50FWkFpPDze/qFs0
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4893) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\zlibwapi.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\officestoragehost.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationProvider.resources.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\j2pkcs11.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\net.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail-ul-oob.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Forms.Design.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebProxy.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\plugin.jar.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\psfont.properties.ja.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Spatial.NetFX35.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunec.jar.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Trial-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.CompilerServices.Unsafe.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\management\snmp.acl.template.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-ul-phn.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL112.XML.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART2.BDR.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ServiceProcess.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-localization-l1-2-0.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\DisconnectSave.jpeg.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Controls.Ribbon.resources.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationTypes.resources.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Threading.AccessControl.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Gallery.thmx.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\sk.txt.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp 60e533b160c4c0a9c6312314b64ea530_NeikiAnalytics.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini.tmp
- Size 83KB
- SHA256 71c368c9c18532e748546071d444c1f55a9d7dbd66cba242f4396c9eccb0e3e0
- MD5 f1a5513a246a9c59b3e7dac8b6a842fd
- SHA1 8d09318efafac46929e7fba93f2d2af70c11a5f9
- SHA512 ba42b930392025da6ecd20850fe9f9efe7e5fa3659b8fc394df8b87a0e6f5404207991162e002a7ef4db77b99d5e482051fb9aa009f5681a477fd39fdd090878
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhZ:6pWpUFpEhLfyBtPf50FWkFpPDze/qFso
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7-zip.dll.tmp
- Size 182KB
- SHA256 41a1fe3747ae7b6a4abc7a1a63f537082459cb8a2a74a20949846ea3f4afb642
- MD5 9cd831a73fd3067c52ab491691113dac
- SHA1 b85c928e7f544a06277d25ce4cba9fc790c68a67
- SHA512 b588655b3f31e12518b466f80ebb79d2d96839f108aff74c82e6468aba6ce618afad288102ef539d58c77472b090e6997c972ba2d778119293483e2f7621b690
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBI:PqFF2Ie+eFTIjNDv0bNXkbvLq
- MD5 SHA1 SHA512 SSDEEP