3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
Size

77KB
MD5

675dd6ad0f26b24feb03c153e2528ee0
SHA1

ecf4370432518a925aa252857b59691f5e2b77f0
SHA256

3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4
SHA512

553d41ae4828d36287a24a40f70a3773ccdd5f1fd1176ab805e23de429a761ea204e1b9db0124e2206c30a94d9e681f6f0bcf465601512f074f46619cdc3ebaf
SSDEEP

1536:/7ZQpApze+ejfFpsJPKZ2wfxRfxzdYaH4c:9QWpze+ejfFpsJPKZ2wf7fVdV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4865) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.AeroLite.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\prism_common.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\msipc.dll.mui.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Tracing.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorlib.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ul.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.Immutable.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jawt.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ppd.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-ul-phn.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Retail-pl.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ppd.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_BypassTrial180-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encodings.Web.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\System.Windows.Forms.resources.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\libpng.md.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEIMP.DLL.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\WindowsFormsIntegration.dll.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3372f7630b27e4ff2d15ec4241d7ffd5010110b31c034a532004fbfb22c64ad4_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4604

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
77KB

MD5
4b67edfc6414bb1c0b0f74af36e6a933

SHA1
2809c6ca419ced08789d7593af5f94096a3c7208

SHA256
e016c6a6aa9f9938442310458714500d652b336507208b058e07c42d3177029b

SHA512
8942427de2f6c4f88436a3107f6639e2c35dfdc13460aacc1f59b7f001166ed6d43544c1b5658433a54ee08ff743314d7566712667c09d861a12a9fad3ba251c

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
176KB

MD5
417d15edbab27d895cb21231c42fbcdc

SHA1
980b2cca0c098456c83df01405b918f4f683233a

SHA256
aab53d80597aa1f67dc5978dede0b1e90e68dd085399ed17db703f951ff5c99b

SHA512
71cdfff1ca755d80c49485b438d2132c9dc526321c621f0f8f5a4733e8b8a00fbdb634840eadb5974ab249949ea93f7a51a0579aa46c98b9b30f7ac833009022

Download Submit
memory/4604-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads