640f6fa7a32a694b0912bd9042ac043f7e1252cb28db7385a3c2060d327d32b7

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.exe/BrowsingHistoryView.exe
Size

558KB
MD5

1642b26deb2ed4d9573712ce2974e85a
SHA1

733a7d59fd23610057c9e6d6c700461bc8517b01
SHA256

cdfb491344d29901d508a8f88dafbc237ffc53e6980106f325764809f58f8505
SHA512

d3fc350e17368c4b73196a7d4d29b62107ba1dd8df4b453fc112921fb8211ecb894df1df44e61387c070e4dffb3a97a53663b32f084a1068bccdbf1983a22452
SSDEEP

12288:bcipgIgwMlLWpBLxSF1md2VkMu7bTMxZ0m41u1zy43gfE:QvIgHSLxMQgVoXTS0x1u1zyqgfE

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2944	BrowsingHistoryView.exe
2944	BrowsingHistoryView.exe
2944	BrowsingHistoryView.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	BrowsingHistoryView.exe

C:\Users\Admin\AppData\Local\Temp\.exe\BrowsingHistoryView.exe
"C:\Users\Admin\AppData\Local\Temp\.exe\BrowsingHistoryView.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...