Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 08:24
Static task
static1
Behavioral task
behavioral1
Sample
69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe
-
Size
46KB
-
MD5
69eca288dd055233d9d421416e3264d0
-
SHA1
386e7180aea80972fcf91d8f68399cfd874ffdb7
-
SHA256
9a5e287d6479da9336969bc8119f5c1c46cc6e379034c305ce734ec002a9e803
-
SHA512
bbde4762f6f31db4609deca9f31e7f0c09fa1394fd41cc91df1cd88fe9ea61c66b4fec938e6749c5103afd5116d4e4be2134fa99395249de8a3c8dfc16a3a34a
-
SSDEEP
768:W7BlpNLpARFbhblkYlkuvIYFdrtf8WUtf8WL:W7ZNLpApCZuvIYXOWjWL
Malware Config
Signatures
-
Renames multiple (5350) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\jopt-simple.md.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-140.png.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\MISTRAL.TTF.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\sdxs.xml.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\Tec.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\UIAutomationTypes.resources.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\InstallerMainShell.tlb.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\bg\msipc.dll.mui.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-file-l2-1-0.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\management.properties.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-pl.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN065.XML.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-pl.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql2000.xsl.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\7z.exe.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINCORE.DLL.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL058.XML.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\mng.txt.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Controls.Ribbon.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\WindowsBase.resources.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-ppd.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\7-Zip\Lang\ga.txt.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Forms.Primitives.resources.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Java\jre-1.8\bin\java.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_KMS_Automation-ul-oob.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp 69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69eca288dd055233d9d421416e3264d0_NeikiAnalytics.exe"1⤵
- Drops file in Program Files directory
PID:3268
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3988,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:81⤵PID:1880
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5d7b1f1a79308a8482b6ce5ec2facc90c
SHA1a8f504fafcd5f06a81c7c0624a1723320fd1f403
SHA25651acba06772f61ebf46aff26683c004856323bf853b75ef06ac8562abee3036a
SHA5126f6c31e177dc19a5e36ae8b9d00f3918c5e00570aba75c49a11e65ab55f672cb96b82d29cdc29ff3ce05850b8636991604467b4e7f9c1ef9aa29ca9024560ee0
-
Filesize
159KB
MD53763512814e21dea40a7318208f8efc5
SHA104cfd7b1a058682fab3db284184df3459ab49196
SHA25616cfc52dba8b0ccd06bc1d1a320cdadc0f7244066b193548c79691e04ea09433
SHA5127130afdb9b0e1ccca9d3b25f7f32dcde675e63d18a3e5fe5f770a5276d06cef003134dcb620aef8f5eb62c15fd3ef31b6d3648f0c99d4dfc6b196e6de5131217