36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
Size

41KB
MD5

a8cb3e8f0e31ea246fd155a18b165af0
SHA1

ef82f88432d0320f52f02c17c2b6b27fc8c3f9a3
SHA256

36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712
SHA512

2f4d9b8b72b790fdecc986ba74d2c818fae6546197c5fba07bc38ee44bb52b029907eae0e2d6b11e1d5b4235f1552bc1023de7fa9b8a6cd13b542223e0177216
SSDEEP

768:W7BlpppARFbhknrSLmsNw/NwuhoYh44eFZIXHFJV+hoYh44eFZIXHFJVe:W7ZppApkGvNw/Nwu6Yh44eFZIXHFJV+C

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\PresentationCore.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\MEIPreload\manifest.json.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.AccessControl.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-phn.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.TraceSource.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClientSideProviders.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-pl.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-180.png.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Xml.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Input.Manipulations.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\flavormap.properties.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-pl.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL106.XML.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Windows.Input.Manipulations.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\lib\flavormap.properties.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.tlb.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.EventBasedAsync.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\UIAutomationClientSideProviders.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ul-oob.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Grace-ppd.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-pl.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscorrc.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\icu_web.md.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\WindowsAccessBridge-64.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TextWriterTraceListener.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ppd.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\jpeg.md.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-memory-l1-1-0.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-oob.xrm-ms.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.OAuth.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\coreclr.dll.tmp	36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36fe59ad63ea176edfe717e02ebdbf04d3abb908f01a52f1894ae65f397ef712_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4204450073-1267028356-951339405-1000\desktop.ini.tmp
Filesize
42KB

MD5
6b139b85c27346ee0c1241c071b1b301

SHA1
466c8009117b14fb349228bbcabb420c4a927809

SHA256
d8a2545b6a90acb223d82fcf280bb5723a655e257514f7b8fa445a15debb5b2e

SHA512
fbd48c75bd467dad4b9f79ebfe515b8c998f3372474d33882665c26fc8d901d68a52d5e33e3658c9d629ee02cc897ed7dd93a2611f6455beab2c3448989a5d89

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
140KB

MD5
205aa6aa72401beee7997aa781ea17dd

SHA1
f6a560e391b82a2d4ead7457a5eab95ab8ba9c69

SHA256
7cb79cd909e7530e79235b6eb9d4168abbdef90cc5bfcabc3228087355430f21

SHA512
d6f724360d848adb54c3ef033d1790dff6ef25cb162e567afc03e9d2880749605088f938536bb71f446cdeb7dd014d24024493d1832e35b082ffec935fb6d82d

Download Submit