97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 09:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
Size

40KB
MD5

714c24bbf21168c3e2021461a74a2100
SHA1

f34c8a6b19d9e9be59762591caef3bba889e2a67
SHA256

97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50
SHA512

a939885eb6a61f285389d3b328ecfe9df0d103035bd10897764a86585cffe1e6489a6bc1f0110b37f1158289f79b9c1c63ae35b95172990dada56d8e5fb8f5a7
SSDEEP

768:W7BlpppARFbhbt7Y7FoICOiJfoICOiJOyD:W7ZppApWmFyD

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5326) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-locale-l1-1-0.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Controls.Ribbon.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationCore.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-ppd.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Specialized.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Forms.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-phn.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\rtscom.dll.mui.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ppd.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\DESIGNER\MSADDNDR.OLB.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgrammar8.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\ado\msadox.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.Compression.FileSystem.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\PresentationUI.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jli.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceModel.Web.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ro.pak.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-180.png.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clrgc.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationFramework.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationFramework.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART7.BDR.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODDBS.DLL.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_KMS_Client-ppd.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXB.TTF.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\nslist.hxl.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-80.png.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\97760691b56ab41cad8cbe9b1ec053d01064474aecc24359dac6d13bac861c50_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:1064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:4632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
40KB

MD5
eb65ff00d631b0bbcc474305be7c1643

SHA1
ace538c67eaa5710ecacfd5c27756f8b276dc3a4

SHA256
804abb098692efa07c1a2e799fb6d5f96c5d62b37005ed5b6641ceadf5ada883

SHA512
9b8532ab441bb3b1fd895be631b39c267551c9917625de3583876da6ee7908f289f3bd270504d1efbc3d3122c340026685a15671611b0ee09748e7cbd690a622

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
152KB

MD5
867778ec9d5ae404e81fe19e69b63b46

SHA1
e249aec287e3f1c10a92a11b6d39bceaec73d78e

SHA256
69704d66e7792a04f30f83d0a72500c1284d90a3aeb785596b0a943541ca636f

SHA512
1c752db8294768488fcdc166554a8694399dac6e97e034aef43cbf28fa91eb6b08f1d35312a4078bb9e1c3c0bb49221365f03eb13cd4119f701e95b143e84888

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads