Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
25-07-2024 09:18
General
-
Target
ThunderbirdPassDecryptor.exe
-
Size
1.4MB
-
MD5
b473f4a564c04cbc4842bd5442720ddc
-
SHA1
54e619624b708bcec70fdf92231a1b6db6f7db67
-
SHA256
1c4ceabc9492bdb1bdb4d13420f32d9d1d93c7c880daacb025c3a5a7474e15d4
-
SHA512
48c676463b28a9ba313247dd3985205cb024f712ab955202aad83d4ebc1295dd2683a920bcc734c24b9a0ce9dd2131985c3a5de4a2950f0ad4aa5a6a657df50a
-
SSDEEP
24576:Gsahep9SjR6UB+3zGkzibpjkcI1qMLodpCuiPLECgsjZK:Gs+2J+jkcI17LV3PACgsjc
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ThunderbirdPassDecryptor.exe"C:\Users\Admin\AppData\Local\Temp\ThunderbirdPassDecryptor.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx