349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
Size

98KB
MD5

aa3adbc68bb23df78a3f1eb25e75a470
SHA1

0adf5cc8e9d203f835ed2b318e998832b9e280cb
SHA256

349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e
SHA512

73b0da6bf334be5802baf00ab6a4be6f2e3dd713f3022659154787a8f9051be4d302322b8dfe8ce6e681bfea9624e7455ab0e697e33972898dd33b2af954d43a
SSDEEP

3072:6e7WpMaxeb0CYJ97lEYNR73e+eKZOf7fOw2wSBr:RqKvb0CYJ973e+eKZOf7fa

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4844) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lv-lv.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.Lightweight.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoetwres.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msadds.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\PresentationCore.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet.xml.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.Lightweight.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Grace-ul-oob.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-pl.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\jpeg.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-pl.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\UIAutomationClientSideProviders.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\Welcome.html.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Practices.Unity.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\MergeInvoke.bin.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\eu\msipc.dll.mui.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Handles.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.Calendars.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationTypes.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.password.template.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\tipresx.dll.mui.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\WindowsFormsIntegration.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_CN.properties.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.WindowsAzure.StorageClient.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationUI.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsFormsIntegration.resources.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_sv.properties.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-oob.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ppd.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-pl.xrm-ms.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CHAKRACORE.DLL.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\349dfd45eb436cedb61a0c7a42d2292a29441b31e6dd54bee1f1879183ee406e_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2712

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
98KB

MD5
64746f8771f6a3d41bc2f3340a464088

SHA1
975478dc4cb2938db0b69761c1d5d8e429267d95

SHA256
9a3652a2c2c57dd28a7156df777c20ac6109da65f67db2ea84a3234437cfba29

SHA512
8d64bb2171f8b96202099cb7310f690bf74afeaded076cba92e84cd12e6f05037600db4a4b924c0820ce901556022d5accfb6a7c726c2de352bb59781583a6ae

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
197KB

MD5
ab9b23959423bdc0e4e1205479e35c8c

SHA1
0361f355325441dba66ee1a0d18503d806010e92

SHA256
d2898f428fc52d02786ca7220805279cc2ba8ff422b250450b6273b04e922158

SHA512
47c4caaeb0f2a78239182fd5f9c63fcdc43ae60109a99b0cbbdd7dea820ecbc668f1748c0fa11e3862d2d11fbe3c3c9248f6732133deee5e2a680d9e4e450723

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads