f0b4b60d127a7febae144cc266bc3c9ce7a04c219ebb949a5cba1bf3ade3a1ba

Analysis

max time kernel
85s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

000Micat.exe
Size

211KB
MD5

067add53b711819fef44da05888cdd31
SHA1

34c5f69837c196153ff4002545b0e61731db558d
SHA256

453c75f27cba6fa2fa71b1f43118de6497d1bfc0edf28099d8d4982113ff7301
SHA512

46f951a31c116f55f625477c88a460147150ac8ecade4978d093da2eb8810523f0dbd355da06ac042fcd2d082e503fe574ac287b74fa64aef0546fd752a201c4
SSDEEP

1536:TmkKw3bx6zamSZgxNJETRxwqVewx8a1ccijgc76gevnVlDwQcij6uumcijyhg0El:TmkLNrHANJexwbrgFHug0EOJrnXK

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	000Micat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{986489CF-2F12-11EF-92F1-DAA7D34B912A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d24b7b1fc3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f0000000002000000000010660000000100002000000075c6f1f44aa8413ef0b7dc8d4654ddad9c88f5d72564b7b95bf9542344618633000000000e80000000020000200000003cdd0f3c57ac48950b32cedda34946de5597998be2b00f12ea1ea144699f903220000000907ae5ef23bdd667a3cdb80836d91742a0b663a7f10c9c831d8c4a2dfff104dc400000000a62e311d602d8d10bea0844f6e32a068e945d1510e478a637d877cfd5a9882d2a77b5d5c738259c653556a50951fee314e59bbd7a302c5ff6799c6af75fecd2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425056117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f000000000200000000001066000000010000200000005887f43d055cd6ed5e256375f85940cd726e693886127eed1af78e09e89a656e000000000e8000000002000020000000b35ee332b3929993758e9c04251396ccc11a834c6b498713500ba4cabce5a6c0200000000a67bbaa324627d2d045d619ea5a1126b4255b8803fa36837b1cee224e97a0c34000000081df1ab46508d06dbd600979cd8f1a47c38bc705f8b7466fde8dd3dbdf13146a249ba9f13e1213d5d4c7fe3d1c42030c6efab2c7af0426abc9a5ef073b7bb746	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fe527b1fc3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	iexplore.exe
2908	iexplore.exe
5008	IEXPLORE.EXE
5008	IEXPLORE.EXE
5008	IEXPLORE.EXE
5008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 2908	668	000Micat.exe	85
PID 668 wrote to memory of 2908	668	000Micat.exe	85
PID 2908 wrote to memory of 5008	2908	iexplore.exe	86
PID 2908 wrote to memory of 5008	2908	iexplore.exe	86
PID 2908 wrote to memory of 5008	2908	iexplore.exe	86

C:\Users\Admin\AppData\Local\Temp\000Micat.exe
"C:\Users\Admin\AppData\Local\Temp\000Micat.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:668
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://wap.micat.cn
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-0-0x00007FFDD5065000-0x00007FFDD5066000-memory.dmp

Filesize
4KB

Download
memory/668-1-0x000000001C1C0000-0x000000001C68E000-memory.dmp

Filesize
4.8MB

Download
memory/668-2-0x00007FFDD4DB0000-0x00007FFDD5751000-memory.dmp

Filesize
9.6MB

Download
memory/668-3-0x000000001C690000-0x000000001C72C000-memory.dmp

Filesize
624KB

Download
memory/668-4-0x00007FFDD4DB0000-0x00007FFDD5751000-memory.dmp

Filesize
9.6MB

Download
memory/668-5-0x0000000001690000-0x0000000001698000-memory.dmp

Filesize
32KB

Download
memory/668-6-0x00007FFDD4DB0000-0x00007FFDD5751000-memory.dmp

Filesize
9.6MB

Download
memory/668-7-0x000000001FD90000-0x000000002009E000-memory.dmp

Filesize
3.1MB

Download
memory/668-8-0x00007FFDD4DB0000-0x00007FFDD5751000-memory.dmp

Filesize
9.6MB

Download
memory/668-10-0x00007FFDD4DB0000-0x00007FFDD5751000-memory.dmp

Filesize
9.6MB

Download