3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455

Analysis

max time kernel
146s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
Size

38KB
MD5

87469d0e6acd815140f6bc81171caf70
SHA1

b7114c1eba81feb94fdcfa37bd9933825d0e036f
SHA256

3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455
SHA512

f804dd8d82f73a21c72e48e2f5ef80988a85812038d1d1ffedc1d8fb0eed680545879cc8c3c6ee4838f8817641462b83b04500876f4e3f0728c92b880e065f89
SSDEEP

384:GBt7Br5xjL9AgA71FbhvuNBN10wpAp/lvolGClvolGUqoICOiJfoICOiJtk:W7BlpppARFbhbt7Y7FoICOiJfoICOiJS

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4675) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOARIANEXT.DLL.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\management.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\dom.md.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ul-oob.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_MAK_AE-ul-phn.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Permissions.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jfxswt.jar.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Ping.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PenImc_cor3.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationUI.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\pl.pak.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Input.Manipulations.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ul-oob.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordbi.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Xml.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ul-oob.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_K_COL.HXK.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.Primitives.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationUI.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSZIP.DIC.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Retail-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\16\Built-In Building Blocks.dotx.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Configuration.ConfigurationManager.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\clrjit.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms.tmp	3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3386b0b3a2f566952cbe46027359eed46aabc89ecbbcc7b22d6d35c3d1114455_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2804150937-2146708401-419095071-1000\desktop.ini.tmp
Filesize
38KB

MD5
426af5da2d8a1b593a2de54fa079e771

SHA1
17162963417b2b24757f23bc4ad3bc06e02121b2

SHA256
f87f1f1d87234de5fc385ca4ba6d97720c9c27666485074668c12493404e4501

SHA512
423b69a40ba23d4d799992f831be915bfa826c57bb174fd62aad35412a3554fbd82789e330681072c77546507be6aec0ec392e852e59995bc2975760f877f1fb

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
137KB

MD5
f5b1fb215e3489753e70c81a65ccaf84

SHA1
56040dc62f9c740f604d622d8efcb81582c01c96

SHA256
a7b825bd750c2fa808fa4408ce02befdad3528e74938b3051b4b2dc1be640632

SHA512
d2d3903d41bbeebdc4cb839fa927afa460a68311527c8c010b8db6d9209f3ceec4ac2286fae6f869c886e280c446e5caaad52369666fe15f380cc106d9307f79

Download Submit