3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
Size

59KB
MD5

4b8a1ef963a45977ad304948dabcce60
SHA1

0d754fc899fa257ec51b04fd6a882aa882764387
SHA256

3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e
SHA512

11655f321e28eaee60c6804c256eb30f3a862c4ec79e9beb495b07758673d9c89e24f07dad24a7b434abdb02c1dc4547407d0d564c5a3da60326c9d1825f6197
SSDEEP

768:W7BlpppARFbhwEnAAJ+AAJ3LnmJARJA3WzWiXxXQ:W7ZppApwEwnmJARJAaXxXQ

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (1626) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\.version.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-console-l1-2-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Reflection.Metadata.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationNative_cor3.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Diagnostics.Tracing.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.Design.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Core.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\UIAutomationProvider.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClient.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader_icd.json.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-1.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.SecureString.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Resources.Reader.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\WindowsBase.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Diagnostics.EventLog.Messages.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ko.pak.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.EventBasedAsync.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationClient.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\ReachFramework.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ReachFramework.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\PresentationUI.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\System.Printing.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\PresentationUI.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipRes.dll.mui.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-heap-l1-1-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-synch-l1-1-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-runtime-l1-1-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\UIAutomationTypes.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\Microsoft.WindowsDesktop.App.deps.json.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\UIAutomationTypes.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.AccessControl.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\System.Windows.Forms.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\resources.pak.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-synch-l1-2-0.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InkObj.dll.mui.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\UIAutomationClientSideProviders.resources.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Drawing.Design.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TabTip.exe.mui.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\msquic.dll.tmp	3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3902ed549b5c2e2777ccda7d8bdc0a99e89566cd4bc6699fa7701c5a79f6276e_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3740 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
1⤵
PID:4416

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.tmp
Filesize
59KB

MD5
ca131d3ff08c3b77215cf59ba8b966c6

SHA1
8a18afa615487fbb9743a04c366051b35c1e37a4

SHA256
e4fda16409ce3ca4dd1fa7c79d7780926d432211c0d6a1045a4cb336e26f1d2d

SHA512
3e53f97a720d45d0229cfe1e44d6fbb2b4234272467776efb22764d81acfc17e1e11308b5b234e4707c16f643060314520b6d71171f6fa2bf3908196247a2e81

Download Submit
C:\libsmartscreen.dll.tmp
Filesize
59KB

MD5
ffa030fec207a4fd22f86979f8cad252

SHA1
5b912604e17f24694889b7fac55a4f972781f23e

SHA256
9d1594357301d651497432957f4429409a0ee4b6e64ff7481e3ca259146a286e

SHA512
37670e532911b1db1ed916b7ed3cfc71b35456f298636a155e08ea1000ca94e655ea0a54bd12e00cd3edfcd4ca612d014f43d511d6cfef083f19ce9efe56c59b

Download Submit