3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
Size

62KB
MD5

7c3b7b22953ec9a345176aee599e7930
SHA1

e24c6e6de15b3e7b1ae7588ec839299a7ac885ba
SHA256

3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9
SHA512

beafe7c0cad9b125daea77b6fd611b04c48395552df7e56b49d46f52527c3cb5ba177f3bf6d997ec8f7c43f282f53d816db7d5bc4f8c2ede6cd306707b845529
SSDEEP

768:/7BlpQpARFbhWGLF/MF/LEXBwzEXBwvqJFqJ9:/7ZQpApP2I+9

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_COL.HXT.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\ReachFramework.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\PYCC.pf.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\tracedefinition130.xml.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.boot.tree.dat.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Principal.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ul-oob.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\webkit.md.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXmlLinq.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Forms.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Diagnostics.EventLog.Messages.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-string-l1-1-0.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Immutable.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Resources.pri.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_Grace-ppd.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Retail-ppd.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\FA000000003.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONWordAddin.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XML2WORD.XSL.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Royale.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\msipc.dll.mui.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Forms.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-pl.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-pl.xrm-ms.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.DiagnosticSource.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationClient.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\card_security_terms_dict.txt.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\PresentationUI.resources.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp	3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3985e7bff00a72316e97105356868166b7d65cf417f5f583ac7367d7993b5ab9_NeikiAnalytics.exe"
1⤵
- Drops file in Program Files directory
PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
62KB

MD5
54eb0aee28446cf326eb237eb91f960b

SHA1
a3b126c5c4dde75647791bb9c1324901d69972a3

SHA256
2fff31971d85a1db2fa92bfb9fd68e29d54cc0de2b772b8fcdee342791cbb341

SHA512
ec15bf97252b0613bd2afaf895985723be53e96a35453fc6200eac17d8a770c6994fe78d7255344f8a495752b16aeabc3acd14c61f08bd6769c14a8981895b14

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
161KB

MD5
75cdd503d2f9f8c3b20097a1e6013ade

SHA1
3e226d644daf5758e0570419233fae578d0a8a74

SHA256
79db300bc6d4a6407862dc77e3b6dd2a0f13653d242851ad854beeb345b2b4f9

SHA512
98fcf7e5423cdd0ea04a0f03688ded4b8d6e8297d8e6c38911690107bad195198239fb48c0fa8a6575a18e1afab9fddd7956b9f80746c8c668e70677c710061c

Download Submit
memory/5060-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5060-1882-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download