808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5

General

Target

808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Size

2.4MB
MD5

90f330e9aea1c202431e165b7283f12d
SHA1

c1f698232d8f7f409ff44a8eebe7ee736d9448d6
SHA256

808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5
SHA512

9b930893ca7542750e53f59270724535e867b258d3edee0abfa8ea9c2d853f01a5ea30f33e689fcd175d95bab01fd7787561a0c515378416d1fadcac886ed2a9
SSDEEP

24576:xFDoJJJJJJJUf96H0P/Hg2oczJdN81MJMddcA0D2itrqEzioc8iHNFu:mHZ5KA0D2itrqEzioc8MNFu

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002ASync = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002A = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InProcServer32	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\ = "TINTLGNT"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID\ = "{1C092C21-882C-11CF-A7BB-0080C7B2D682}"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer\ = "MSIME.Taiwan.1"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ = "TINTLGNT"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID\ = "MSIME.Taiwan.1"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CLSID	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\ = "TINTLGNT"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID\ = "MSIME.Taiwan"	808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe

C:\Users\Admin\AppData\Local\Temp\808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe
"C:\Users\Admin\AppData\Local\Temp\808319a22e8d87f417cee2b7243211ba3441cca43e78f1c266292549c8416dc5.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads