f0b4b60d127a7febae144cc266bc3c9ce7a04c219ebb949a5cba1bf3ade3a1ba

Analysis

max time kernel
85s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

000Micat.exe
Size

211KB
MD5

067add53b711819fef44da05888cdd31
SHA1

34c5f69837c196153ff4002545b0e61731db558d
SHA256

453c75f27cba6fa2fa71b1f43118de6497d1bfc0edf28099d8d4982113ff7301
SHA512

46f951a31c116f55f625477c88a460147150ac8ecade4978d093da2eb8810523f0dbd355da06ac042fcd2d082e503fe574ac287b74fa64aef0546fd752a201c4
SSDEEP

1536:TmkKw3bx6zamSZgxNJETRxwqVewx8a1ccijgc76gevnVlDwQcij6uumcijyhg0El:TmkLNrHANJexwbrgFHug0EOJrnXK

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	000Micat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002322fad14fdb874f8edc4f7e0cc1913e00000000020000000000106600000001000020000000a2270ddee2bdf9d3a9978db185f630d4ae27da827d326559f8b3555cf5752738000000000e80000000020000200000008b96a701bb7383347ab87f1bdfdb962c42e97710a8ef4bb1ce8cd62437644d9e200000004802e0f8445cdbb3f023bda462683dbf7a926617e14cd6fd77cfea212b67b7b3400000001e8c65bffd265d7e617aabb8b13d2c4aad01786b7ffb119efa9718c7ce7afcf0785793a3b424ea82a9fadf60dc0c3b5c5da77a788bd52c20b0afd7156eb3b056	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002322fad14fdb874f8edc4f7e0cc1913e00000000020000000000106600000001000020000000ecc9d2ef949018586e2ea33b26b8d96981f832e5d9cad86ec6a4dc7a08afda54000000000e80000000020000200000003dd43bfd1d182e39fac0d3e57c5f86c4b586467eb34f3d4667ee0ef09798bc2f20000000891c71f3d4905ed4ffbf5ce92ec9fe089471e985bf152d176f0d6a78c7b7caf84000000084bc4bca4fe433ad223b334f1e697ba9cf0da12c7c23f7968e6d096381ef568aa6c8c5f693174d440be7cfce9b0ded90d778d4fa4cbe5e94581346ffd97969be	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cd447b1fc3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{986710C8-2F12-11EF-BA70-6E6D447F5FDC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425056117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f94b7b1fc3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1804	iexplore.exe
1804	iexplore.exe
5056	IEXPLORE.EXE
5056	IEXPLORE.EXE
5056	IEXPLORE.EXE
5056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 1804	5024	000Micat.exe	80
PID 5024 wrote to memory of 1804	5024	000Micat.exe	80
PID 1804 wrote to memory of 5056	1804	iexplore.exe	81
PID 1804 wrote to memory of 5056	1804	iexplore.exe	81
PID 1804 wrote to memory of 5056	1804	iexplore.exe	81

C:\Users\Admin\AppData\Local\Temp\000Micat.exe
"C:\Users\Admin\AppData\Local\Temp\000Micat.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://wap.micat.cn
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5024-0-0x00007FF8B2355000-0x00007FF8B2356000-memory.dmp

Filesize
4KB

Download
memory/5024-2-0x000000001B9E0000-0x000000001BEAE000-memory.dmp

Filesize
4.8MB

Download
memory/5024-1-0x00007FF8B20A0000-0x00007FF8B2A41000-memory.dmp

Filesize
9.6MB

Download
memory/5024-3-0x000000001BF50000-0x000000001BFEC000-memory.dmp

Filesize
624KB

Download
memory/5024-4-0x00007FF8B20A0000-0x00007FF8B2A41000-memory.dmp

Filesize
9.6MB

Download
memory/5024-5-0x0000000000D60000-0x0000000000D68000-memory.dmp

Filesize
32KB

Download
memory/5024-6-0x00007FF8B20A0000-0x00007FF8B2A41000-memory.dmp

Filesize
9.6MB

Download
memory/5024-7-0x000000001F5C0000-0x000000001F8CE000-memory.dmp

Filesize
3.1MB

Download
memory/5024-8-0x00007FF8B20A0000-0x00007FF8B2A41000-memory.dmp

Filesize
9.6MB

Download
memory/5024-10-0x00007FF8B20A0000-0x00007FF8B2A41000-memory.dmp

Filesize
9.6MB

Download