818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
Size

98KB
MD5

661eb4bacea3fb0877e2f67be19699d0
SHA1

bd0e7245e20c5671a06fae24ac337f0e76efa03a
SHA256

818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41
SHA512

e20d1d45281f08451359106bbf99291dc638e528328057ce0e97b2574a2304d073a07c028c1427d79f5515323ee2248d40ec9d223facf135523157428ab046b9
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBP:PqFF2Ie+eFk

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4846) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUIFormulaBarModel.bin.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.resources.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationCore.resources.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ppd.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeOneNote.nrr.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Grace-ppd.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClient.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-heap-l1-1-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ppd.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.MemoryMappedFiles.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.resources.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Controls.Ribbon.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-pl.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mfc140u.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Timer.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSVG.DLL.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\v8_context_snapshot.bin.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-pl.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-80.png.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.scale-80.png.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Services\verisign.bmp.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.DataAnnotations.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Extensions.dll.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md.tmp	818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\818d91d791ed3dac2ab09784234304e5b2757ef10e07d87647843855a4175f41_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4432,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
1⤵
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3665033694-1447845302-680750983-1000\desktop.ini.tmp

Filesize
98KB

MD5
67663c2a73e2e9234020df9f12c8d74c

SHA1
8e55b61b89079321d2ed2176fbd5eff7fee69c08

SHA256
0b644e09ce995827879e4a71d1709e96ddb0bdc75cda1ab80740dc65f9c2837e

SHA512
2224d6e062dc929e0478da7311cbf135c9c5d30b385649374f5899b0a0370271f2361029daa7764c0fc29f083a5d454a9323e8187e6c62df81d8ede7444e587f

Download Submit
C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
210KB

MD5
82082566754697f9d07659020ac7244d

SHA1
99da6667c8eca8f0f748b18ad07bdc1844a4c255

SHA256
63fe4379a722bf46fb22396183eca1886fc33b4dded4dd4f718abeef3a13420f

SHA512
8a7c8ded9643adaf2c572bac71ed9ad5d82144525479b6025abc0700cf010c0507c0676f2a38d6725bba788df89fae02d13cb483967d8b02271a6aec22bcc118

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads