8513ac042c987c6d67779b532018e46be4762b3a6082348c53ab49ba7ac91b5b

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:19

Target

binaryninja_personal_dev_win64.exe
Size

318.3MB
MD5

e8b7a7fb698cde64cff050acaa9b49e1
SHA1

0a2dd14ef45710728116638a2fb5410d4183969c
SHA256

952154583e3af0bbcaf6b612796f9e4b9d7cf80cf95a1effbde5100bb74f71f4
SHA512

07fb8f8890205b91846616c5f96b05699dee150d51cc89a899e1dfc4cac7b5d93c28cb541fd8c2aeea018f81fe44cda5b98c59bd0cc5cb3a06d1f8c65424e093
SSDEEP

6291456:y8jLChoB7TdupLNynB8xRO1JrnYqOh5GaU551kmYIDauKl0tvm1zaFDIGjMsT86C:y8jLQoB7hMPxRO1JLYqOOa0511O2oJau

Score

4^/10

Loads dropped DLL 3 IoCs

Processes:

binaryninja_personal_dev_win64.exe

pid process

2176 binaryninja_personal_dev_win64.exe
2176 binaryninja_personal_dev_win64.exe
2176 binaryninja_personal_dev_win64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

binaryninja_personal_dev_win64.exe

pid process

2176 binaryninja_personal_dev_win64.exe

pid	process
2176	binaryninja_personal_dev_win64.exe
2176	binaryninja_personal_dev_win64.exe
2176	binaryninja_personal_dev_win64.exe

pid	process
2176	binaryninja_personal_dev_win64.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\nso4117.tmp\System.dll
Filesize
11KB

MD5
0063d48afe5a0cdc02833145667b6641

SHA1
e7eb614805d183ecb1127c62decb1a6be1b4f7a8

SHA256
ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7

SHA512
71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0

Download Submit
\Users\Admin\AppData\Local\Temp\nso4117.tmp\UserInfo.dll
Filesize
4KB

MD5
e167f9a565781a30c03ff10370033319

SHA1
1858758b076946073de375c6eb1bec9867aa3689

SHA256
a912514823df595ba3a048099d3b89e925a4d41742afc67e772060952892f312

SHA512
96d8f5ac8e2c0961ba71075de52d12515e7a058cddf3fa1ec14e77545b0b5f4e29324a13e2eb287a447f1d24dc9f09e0a70b0a25401b0ef8d90e6e4a96ce6c61

Download Submit
\Users\Admin\AppData\Local\Temp\nso4117.tmp\nsDialogs.dll
Filesize
9KB

MD5
6e64e5d5f9498058a300b26b8741d9d5

SHA1
837ce28e5e02788da63a7f1d8f20207d2b0bf523

SHA256
8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33

SHA512
f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e

Download Submit