80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9

General

Target

80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Size

2.5MB
MD5

e1f0bdef72f9ef824edb63b4a0a839fb
SHA1

2acb0868c650282e4d8e1ad3dad0034e327d7913
SHA256

80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9
SHA512

aa5588c1f32db43ef456167beb8b3ae1ed91c8c15a10bf7f88b61437573bfa67503cbc5887d407af907f70d84b962a1ad6624001e907a45cb77725b2190441d8
SSDEEP

24576:GqmTM+V8tgJd80kqmTQ96H0rqmTYlSa1ciW96H0/:GqCM+V8tgJd8ZqCdHGqCN4cirHC

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002A = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002ASync = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID\ = "MSIME.Taiwan"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ = "TINTLGNT"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID\ = "MSIME.Taiwan.1"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\ = "Microsoft New Phonetic IME 2002a"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID\ = "{1C092C21-882C-11CF-A7BB-0080C7B2D682}"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32\ThreadingModel = "Apartment"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\ = "TINTLGNT"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CLSID	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer\ = "MSIME.Taiwan.1"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\ = "TINTLGNT"	80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe

C:\Users\Admin\AppData\Local\Temp\80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe
"C:\Users\Admin\AppData\Local\Temp\80ebd186ddad0bdc1962d1d4edd7adb2ce986c5a39eb6c09563ad9864b7910a9.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads