85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0

General

Target

85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Size

946KB
MD5

f4627312475232ab2fb09dc5e552bd29
SHA1

e1fd4dbfaa66501e96b0cafff305da75220b687b
SHA256

85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0
SHA512

f03957439e85ef53607eaeafab08557f7f2f968d711c1c7b7b583126100e96bad850cf4a4688ac60226ff4e03683b8aaf6bd88025b01cf2d11c374575249c08a
SSDEEP

12288:GykjBYiC2A0xCRAfP6ppgg2HFZlxEykjBYiJ:XcS2A0ERyqmTJcZ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002ASync = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\PHIME2002A = "C:\\Windows\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID\ = "MSIME.Taiwan"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\ = "TINTLGNT"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID\ = "{1C092C21-882C-11CF-A7BB-0080C7B2D682}"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ = "TINTLGNT"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CLSID	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InProcServer32	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer\ = "MSIME.Taiwan.1"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\ = "TINTLGNT"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan.1\CLSID	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\InprocServer32\ = "C:\\Windows\\SysWow64\\TINTLGNT.IME"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\InprocServer32	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSIME.Taiwan\CurVer	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\ProgID\ = "MSIME.Taiwan.1"	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C092C21-882C-11CF-A7BB-0080C7B2D682}\VersionIndependentProgID	85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe

C:\Users\Admin\AppData\Local\Temp\85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe
"C:\Users\Admin\AppData\Local\Temp\85c407112bc191ef5c78867b09299260749eb07eb75441f9a94c89e89d5f58f0.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads