2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6

Analysis

max time kernel
57s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
Size

40KB
MD5

feb761cc1b3b2f8626a71194efa46510
SHA1

eafe20d4f79124efcafc0b704cbad63856f02c2b
SHA256

2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6
SHA512

eac6c88345f34f0c28ce2fdb476553c2f1a4507264b24d17d007a4d9777384acfd01439bafdf5bb06cfe0378ff43940b614765dc4024b2b7ee574138d0663f9a
SSDEEP

768:W7BlpppARFbhbt7Y7FoICOiJfoICOiJQ444Zqu:W7ZppApWmjXs

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (224) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\nb.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ext.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tipresx.dll.mui.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipRes.dll.mui.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\BlockDisconnect.wav.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Uninstall.exe.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\fi.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2f671b32a2522a38b652f5378ac0e91efa59aa6d508ab672df642f00d82b9de6_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2232 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
40KB

MD5
1ca8ff2a59b86fe54a2f33dfef1169cc

SHA1
3efe95c6188ef9cc9837729ea0990d3fb6c1789f

SHA256
9139a94e1359cbbfd6929a0d453ef940063593dac46fcc479ebb504705da2565

SHA512
42ec8775173ff3ff9358d5d8dcf403fcc89e04e8429c8ee8b959d8f02be7d349659c25f84b8b4bec78d4d41b62a428cec17b6fbf433a671f1f5f631f5ce7e8d6

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
40KB

MD5
ea7daec45e7faa7116ff6e7af700c85d

SHA1
1d3f4b9a753ae05bd35aa555d9e17a5d96538f4f

SHA256
fea82563aae8697b38edcf1cd8c8ef414500cccdad444d9409da8b30d0c9fc31

SHA512
942f684092856e2c77b8fdbb6088bf4c1ffff8abc062cd15e6cc3ff35ec3c6721e1aabac7c0dc68a377c3ed57fe06c538ea8981781f85807baf5990dfb334345

Download Submit