Analysis
-
max time kernel
170s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 18:09
Static task
static1
Behavioral task
behavioral1
Sample
48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe
-
Size
348KB
-
MD5
822435c103d0124846527bab0c8338c0
-
SHA1
40a0af433913c317094d8aefb39ca59b36f8edd1
-
SHA256
48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91
-
SHA512
6143ee1e6b717f9f31e2f8dccddb28362a6463f7ae8cc507cb7895966d26c78ca38257d685e5c19458042694944a92bcb18d5ea3431d45cae38fe3a06a5bf3a6
-
SSDEEP
6144:KJ5I5RwMGznVDZECBKRZOc3Rzjgk2gnsGQAHMDjHV:s5aRpGzVDZErzOcBONpDjHV
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gpscript.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\0fx48ci0.default-release\\bookmarkbackups\\rdrleakdiag.exe" 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mfpmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mfpmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mfpmp.exe -
Enumerates system info in registry 2 TTPs 9 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mfpmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer mfpmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Robocopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Robocopy.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName mfpmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Robocopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" mfpmp.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" mfpmp.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main mfpmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2388 mfpmp.exe Token: SeDebugPrivilege 4120 Robocopy.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4068 wrote to memory of 2388 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 81 PID 4068 wrote to memory of 2388 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 81 PID 4068 wrote to memory of 2388 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 81 PID 4068 wrote to memory of 2388 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 81 PID 4068 wrote to memory of 2388 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 81 PID 4068 wrote to memory of 2388 4068 48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe 81 PID 2388 wrote to memory of 4120 2388 mfpmp.exe 82 PID 2388 wrote to memory of 4120 2388 mfpmp.exe 82 PID 2388 wrote to memory of 4120 2388 mfpmp.exe 82 PID 2388 wrote to memory of 4120 2388 mfpmp.exe 82 PID 2388 wrote to memory of 4120 2388 mfpmp.exe 82 PID 2388 wrote to memory of 4120 2388 mfpmp.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe"C:\Users\Admin\AppData\Local\Temp\48052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\mfpmp.exeC:\Windows\System32\mfpmp.exe2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\Robocopy.exeC:\Windows\System32\Robocopy.exe3⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4120
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0fx48ci0.default-release\bookmarkbackups\rdrleakdiag.exe
Filesize348KB
MD5822435c103d0124846527bab0c8338c0
SHA140a0af433913c317094d8aefb39ca59b36f8edd1
SHA25648052cfefd5bbb8cf358917f095b80c91be95ffe7ed5b6949a80e49b7a2dfb91
SHA5126143ee1e6b717f9f31e2f8dccddb28362a6463f7ae8cc507cb7895966d26c78ca38257d685e5c19458042694944a92bcb18d5ea3431d45cae38fe3a06a5bf3a6