48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
Size

48KB
MD5

116de5b2d018e63c777da70e943ad8d0
SHA1

e4454d4d38f32baa3cb7d78c4893a06df24d8f06
SHA256

48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710
SHA512

1f4fbea41e0299100f0df2ff68ae97c5859b4f32fd85d8fa11d05358ca20d84c9f07bb4a2d4a85f5828f00033181d6fd70e03d9a1ae47208fa16f825d47ce896
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBNsjLKoWFKryoWFKrRYKYUosMosnn/oA/op9IsS:W7BlpppARFbhWJq5nosMosa9IsS

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.NonGeneric.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ul-oob.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PRISTINA.TTF.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\PresentationUI.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\sv.pak.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\eula.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Csp.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.manifest.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.ValueTuple.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\logging.properties.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-phn.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSSRINTL.DLL.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.Linq.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\Microsoft.VisualBasic.Forms.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OSFPROXY.DLL.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excel-udf-host.win32.bundle.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-ul-oob.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntryR_PrepidBypass-ul-oob.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.DataWarehouse.Interfaces.DLL.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Top Shadow.eftx.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-pl.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationCore.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationUI.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\Microsoft.VisualBasic.Forms.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremDemoR_BypassTrial365-ppd.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeWord.nrr.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Primitives.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\optimization_guide_internal.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\zip.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_OEM_Perp-pl.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.CSharp.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\PresentationFramework.resources.dll.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul.xrm-ms.tmp	48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48b9e425e584c511b0ed01a410d20f79e0c93277fa4980c43ebdb2f65b4d2710_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4340,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
1⤵
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.tmp

Filesize
48KB

MD5
a5e1de470c3f0ebf143edf2c09433ee4

SHA1
9c5628b33713e935eb5f469ecb5197ecfb413ea2

SHA256
b36ef96cb55cf8fb5d4c1b7784091d209eac389bd69bde651085d2e8c0480488

SHA512
4bc8e01e318f93ddf6576f58dae1cc7567b8ed054d97a59471b79746752d6d5d18f80221bbffb2c62ff012f799daffd5e0c07455be88c5c67a297179766336ab

Download Submit
C:\Program Files\7-Zip\7-zip.chm.tmp

Filesize
161KB

MD5
2c43b9438a75ad07706afe0fdc9748e7

SHA1
0d8dda1074faaf6dcd2083ce5bb77283449589f8

SHA256
df297d91135d025f78ea620c0f9b556b0a56d10e9b06dc33983f9e6bb0d5dd59

SHA512
4a6d9a6b64ffae7074aec9710a8c70c4dcb73fddca10454e08b56baff76734196fe07d7fbd2a1f0c61c4841ce33ba76bac47f9f4e9bbb797305621ebe0738d72

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads