82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a

General

Target

82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Size

2.3MB
MD5

66d9374cb8b23b992bc8708a92fd2e38
SHA1

ab43568aa7f05d659baa6e8ed694c14ebba20220
SHA256

82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a
SHA512

81a4756b51a66802512ca5c2d68fd8d0a18d4e7d66f4734eeef05a53b695f7eb907150464c4ce8025bfc3cd825d41e81a830691ccf00b5d53441081be9bfad85
SSDEEP

24576:q9JJd3n+Otv2K5iP7iQ96H00A0xDoJJJJJJJUh9JJd3n+Otv2K5iP7i:qOyCPOdHEiOyCPO

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002ASync = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002A = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\ = "TINTLGNT"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID\ = "{1C092C21-882C-11CF-A7BB-0080C7B2D682}"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID\ = "MSIME.Taiwan.1"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InProcServer32	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\ = "TINTLGNT"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ = "TINTLGNT"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID\ = "MSIME.Taiwan"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CLSID	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer\ = "MSIME.Taiwan.1"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID	82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe

C:\Users\Admin\AppData\Local\Temp\82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
"C:\Users\Admin\AppData\Local\Temp\82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads