929adcf731e730ee1251eeef8513fd774b1357c1c3e1da4d287722ed778434f9

Analysis

max time kernel
128s
max time network
139s
platform
windows10_x64
resource
win10-en-20211014
submitted
20-10-2021 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

San11 Tc/LinkSan11Res.exe
Size

2.7MB
MD5

db509fc939b15b8f1276ed1c07bb98e7
SHA1

faaa5e7aceb02c14bb466320850697bfce0f39a4
SHA256

224657b8adef1a3eb9784d924a730751a05f9aa93b48628b1bfa1f058486169d
SHA512

f1db7985c312bd7715919506c6736a02f3956b91b6a8f1d75b1a7b693566dbd452e3b160d218a0ccc00645e60dcb06b9af95f5427b69cc67e57ccb16cfb6375d

Score

1^/10

Malware Config

Signatures

Modifies registry class 36 IoCs

Processes:

LinkSan11Res.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LinkSan11Res.Application\CLSID\ = "{8C306064-52F3-4724-A485-3C44005E7ACA}"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\FLAGS	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\ProgID\ = "LinkSan11Res.Application"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\LocalServer32	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAN11T~1\\LINKSA~1.EXE"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}\ = "ILinkSan11Res"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\ = "LinkSan11Res.Application"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\ = "LinkSan11Res"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LinkSan11Res.Application	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LinkSan11Res.Application\ = "LinkSan11Res.Application"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}\ = "ILinkSan11Res"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}\TypeLib	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LinkSan11Res.Application\CLSID	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\InprocHandler32	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\InprocHandler32\ = "ole32.dll"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\0	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\0\win32	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\San11 Tc\\LinkSan11Res.exe"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C306064-52F3-4724-A485-3C44005E7ACA}\ProgID	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}\TypeLib\Version = "1.0"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\HELPDIR	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\San11 Tc"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}\TypeLib\ = "{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}\ProxyStubClsid32	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}\TypeLib\ = "{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}"	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{9AF99991-DFC9-4700-AF3C-3C0B0CF66BA5}\1.0\FLAGS\ = "0"	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}\ProxyStubClsid32	LinkSan11Res.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{732E9066-5337-406A-83D1-D4A330635214}\TypeLib	LinkSan11Res.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{732E9066-5337-406A-83D1-D4A330635214}\TypeLib\Version = "1.0"	LinkSan11Res.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

LinkSan11Res.exe

pid process

1676 LinkSan11Res.exe
1676 LinkSan11Res.exe

pid	process
1676	LinkSan11Res.exe
1676	LinkSan11Res.exe

C:\Users\Admin\AppData\Local\Temp\San11 Tc\LinkSan11Res.exe
"C:\Users\Admin\AppData\Local\Temp\San11 Tc\LinkSan11Res.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1676

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads