04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
Size

46KB
MD5

206a36e5a3842f77d09d02886fec0620
SHA1

c504dfafd05183c72367fe55eb74639553d49276
SHA256

04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a
SHA512

88f36a8d6a13e0f8f2b89c8997d06a3933307f2dd6ea4e30e1bac174c260a97778c3f503f93f22d11705737638960085590f17d70c3eff4f67302b63d5585500
SSDEEP

384:yBs7Br5xjL8AgA71FbhvhwMF1XxXEh+v82:/7BlpQpARFbhtF1XxXEhk82

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5235) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-pl.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\adojavas.inc.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\jaccess.jar.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Trial-pl.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\PresentationUI.resources.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ast.txt.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHSRN.DAT.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.XmlSerializers.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_en.dub.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\net.properties.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwclassic.dotx.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMB.TTF.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Extreme Shadow.eftx.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ppd.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.BackEnd.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationNative_cor3.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\InputPersonalization.exe.mui.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-phn.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Primitives.resources.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ul-phn.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OleDbInterop.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Threading.AccessControl.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationCore.resources.dll.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms.tmp	04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\04843c71cbf3093e5dd6f280898dd28c0825c21b7f76640be25fd7abc1ae730a_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
46KB

MD5
1e9acc3bcbe0007aea9d72045c312fd5

SHA1
f95a8d44a41e9876a69e2a4c353208d2b2f75063

SHA256
60d2137f8315a7b84284649243694e134b40e875b1c68cfce8f2151613806722

SHA512
4df381002f78524ecbd3e3871c938f73a9b93319726acc263279559532c368187372c2c7e79d9d57ac59a76f47b756add6bc82be2dff516c0d75e197e7580274

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
145KB

MD5
385bdcea7944c82303ec2e058952923f

SHA1
fb4d7487a39f5608b9be79304c734aa0c4242def

SHA256
c16740145e93f26e4f3a9716679dd887977203b3fb494c7fd6baa7eb7d4c4733

SHA512
989d5404a0fddfc129c5a2a8346b83ebe3ad4233cab6bd918141daead7b50bdce13c89bf9ed75fc36b08e700148cec6ba1089d91fdec9dfd04863c9be51b9cb9

Download Submit
memory/3552-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3552-2012-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads