Analysis
-
max time kernel
141s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
12/08/2024, 03:32
General
-
Target
MozillaHistoryView/MozillaHistoryView.exe
-
Size
42KB
-
MD5
e47b3c7dd2e761188ad239810f0677dd
-
SHA1
694cd12c0777a1fa3612032a32d526158c3eac99
-
SHA256
907a44a9dd1ea6567d607eb2a73e25b28c2a6cf98951e55c1e5c0b58e86b2d8d
-
SHA512
baaa7dfbc87340582b242bf9496e972155e4c83c75bcf94d891d0ca446518aa9b70a0c41b1ebc160893de4ff2488ab7e1f04fa417bb995ed7e874006c64e4315
-
SSDEEP
768:60Wg9p1tYNgDtXu9nHpq/Zd789/wwuTM0tSx3xkHJBdR:fR1tYNgDtzZd7o/w3uYTdR
Malware Config
Signatures
-
Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MozillaHistoryView\MozillaHistoryView.exe"C:\Users\Admin\AppData\Local\Temp\MozillaHistoryView\MozillaHistoryView.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
-
Filesize
112KB