8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262

General

Target

8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Size

2.3MB
MD5

0e357598331b83c3729ddd28d047edd5
SHA1

6f0478b0b4399d71ab488a585bd6de2dd27ea709
SHA256

8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262
SHA512

70b6fae3f891d925490f51b3ee33cdf721e7ccfdbf993a1b1273cfb7bf15483ce0b435dd9f8c93c31da018a33b3eaf69b4da04846b9733b817424046f60c8991
SSDEEP

24576:d2aJ9JJd3n+Otv2K5iP7iQ96H0j3pK9JJd3n+Otv2K5iP7iS3z96H0r:dvOyCPOdHY5KOyCPOSEHc

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002ASync = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002A = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID\ = "MSIME.Taiwan.1"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CLSID	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID\ = "{1C092C21-882C-11CF-A7BB-0080C7B2D682}"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ = "TINTLGNT"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\ = "TINTLGNT"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\ = "TINTLGNT"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer\ = "MSIME.Taiwan.1"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID\ = "MSIME.Taiwan"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32\ThreadingModel = "Apartment"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\ = "Microsoft New Phonetic IME 2002a"	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32	8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe

C:\Users\Admin\AppData\Local\Temp\8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe
"C:\Users\Admin\AppData\Local\Temp\8651477cbc959ed2ddbfa4f4648612d11fc3cc8e74026604415f0b66840b5262.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:2288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads