336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
Size

91KB
MD5

f077b635a07070b58a6088bfab2e0960
SHA1

2e1f88a397c510a68a3bb24fb21c5b0b4792f7ec
SHA256

336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87
SHA512

69467f134278abdf477b2b9703d15f3e5b388a2be167e8f45ac3d182b19d759536dd65895d1b0d73a3d36afd48307756b4825587ae8bd781601e065fc0e282c3
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfxRfxHAu39Au3J:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7p

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4633) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.AeroLite.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ppd.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Windows.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationFramework.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-heap-l1-1-0.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\libEGL.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Retail-ul-phn.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-pl.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ppd.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-stil.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\j2pcsc.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Slice.thmx.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-pl.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ul-oob.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationProvider.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Grace-ul-oob.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l2-1-0.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-heap-l1-1-0.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\tipresx.dll.mui.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_2.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul-oob.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClient.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\verify.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusDemoR_BypassTrial365-ppd.xrm-ms.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\336697b398d329aec6f555e22a416b62135595acbf0081cbf0c13b91c81d0c87_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:3892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
91KB

MD5
07073bbe6c367d7754f46a1581fabd7f

SHA1
dd0d41449dd4e124ab631e1ef9204dadc4e717b4

SHA256
2b63ed4f9620f3ae1a104d60956bcc0e7d73df142157f6c53498b8f35d1cab90

SHA512
95b80717c7a07ea5831cd000c9d050cae9a537c6892abb923377d7f8f6171e8cf053e2d7c0526db39e3ce89de056b1c68e39afcefd1010de6fda434a056ad7ee

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
190KB

MD5
dea4fbfb3ba67876a8fa63f9d3f02a9f

SHA1
5ea2fdb20e74b7602ef6e5c56844d366c37069b6

SHA256
544758454dce94ff79d16869bb5310c6adeb81b16755d70681307af4e7c07fd6

SHA512
baef546170fcfdd81f37351b3288e260deb728f80c34623f491ebc691f28055aa6537938c51a1acbf8e2b4d4b5f9b747caefa0b6aa80e8063a756bd9180314ab

Download Submit