0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5

Analysis

max time kernel
150s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
Size

53KB
MD5

de747f7a104369c297617ebb056a5090
SHA1

448034fa4ba591b94c5b3221a1ed806284f67e60
SHA256

0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5
SHA512

6d28e639acd6c81b6f3248e3ff91d91299064ce857736b19c4516641e36f8b4981b795e9ace8e092d3990c1ace0b3abf581241380d3ffb6cb5a41e6ef0cae61f
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrbArA5SJOgArA5SJOnQWp2LWpL:W7BlpppARFbhWJjrA5SJYrA5SJ25pHpL

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-pl.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.boot.tree.dat.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\libcurl.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorrc.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\asm.md.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Trial-ppd.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\osfFPA\addins.xml.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.deps.json.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-pl.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\ReachFramework.resources.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\msipc.dll.mui.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OMICAUT.DLL.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-timezone-l1-1-0.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationClient.resources.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-conio-l1-1-0.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINSHELL.DLL.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Design.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-ppd.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-pl.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Subscription-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ppd.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Interceptor.tlb.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\System.Xaml.resources.dll.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0bd8a526719c10a0735bd3a2140c62a7ad68902da655722fb1eed4cab20ac6d5_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2792,i,1236064252342462940,13180713657498721890,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
1⤵
PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

Filesize
54KB

MD5
5f4a7c2a0eab5780bda9c1f317c56457

SHA1
8fbf337794f48796597b8c6927043f8b5305c998

SHA256
27cf201e59c9d7d1a35ec58ed72b618349dd6ead200ac590f13e0210c616ab84

SHA512
acbe0dfcaaf52f9587b2603e72226e86118ff5966ce7d62f3d02b32770a825c8f6ebe82896402c8fd4acfc5b5822ef832c9d87ee02bbf92a38824efb72015cab

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
166KB

MD5
057ec612973a2d50b73ec55a650e6175

SHA1
12611c732f052371990154e8086631d2aeaeb9ce

SHA256
837cbb7213ebfdb41cf4814618a45893d413efc896b7d4877b313a4622a38449

SHA512
17d9890167432bc530a307aee4a32734b5f4f6b1cf5e5c2c87b5443d10a76cb929134a3d098bcbfb984e177b69b4851780c2213377dde3be1345e04c54f827be

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads