Analysis
-
max time kernel
1800s -
max time network
1688s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2023, 22:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn-fastly.obsproject.com/downloads/OBS-Studio-29.0.2-Full-Installer-x64.exe
Resource
win10-20230220-en
windows10-1703-x64
15 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://cdn-fastly.obsproject.com/downloads/OBS-Studio-29.0.2-Full-Installer-x64.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
9 signatures
1800 seconds
General
-
Target
https://cdn-fastly.obsproject.com/downloads/OBS-Studio-29.0.2-Full-Installer-x64.exe
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133245248615451068" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 3032 chrome.exe 3032 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe Token: SeShutdownPrivilege 4784 chrome.exe Token: SeCreatePagefilePrivilege 4784 chrome.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe 4784 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 4708 4784 chrome.exe 84 PID 4784 wrote to memory of 4708 4784 chrome.exe 84 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 616 4784 chrome.exe 85 PID 4784 wrote to memory of 1940 4784 chrome.exe 86 PID 4784 wrote to memory of 1940 4784 chrome.exe 86 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87 PID 4784 wrote to memory of 4052 4784 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://cdn-fastly.obsproject.com/downloads/OBS-Studio-29.0.2-Full-Installer-x64.exe1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc189758,0x7ffcfc189768,0x7ffcfc1897782⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:22⤵PID:616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3180 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:12⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5268 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5256 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 --field-trial-handle=1812,i,4940830863880577065,14919875113499281852,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3032
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3144
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58599941aaa2bae495f5281dc03234b0b
SHA12dd3ba22a8a91eb6dbdf2b778c029e7211578987
SHA2563587b3a52b27ebfd3a9a70d3d59ed4169262b4f5a3e56f2f9abedf1525929e22
SHA51286137b10c9d9ceae8bbff63ce06857c273259b6251a5de6b10c09fef27c86de9b20a09e2bdb7641d2a8f3a904ed1a1b146dee0f9dba9c9e71ec819a92ad952a5
-
Filesize
6KB
MD5f08c8848e38d9d368b7cfa5aa532df75
SHA15f003a99f6ae6fa6f058e7c292bc21b15189f407
SHA256652d49cc4ddb89d1e05e780d445e281e8c54e20a88811505a0185e5f332a0f5d
SHA51244451b52c5c25e9608f47c36dae4ec176524490108c7628665987bb4826e9c0379ab3b43220ced6d520c39cb82efbd3dc1b32d8e6a73e464cac35ccd40a9f5ce
-
Filesize
6KB
MD5a214d67334eb26934204ad286c3d4cd5
SHA1e97ffc907d6f31177e9dab08450e8302be65752a
SHA256cf1d052423ef253bd19aceba528bc4c876b39dc3e9ee0915e07d0ffa3410602c
SHA512a40ff95372ed7dfda116768e8bc3357aaed29946e035447395bb93d700f17257c2ade7b6acab01e1d99d283434189e409810481998cf7e8299b4516ec50b38fc
-
Filesize
15KB
MD5417d4cf18c107712a66135471cf06deb
SHA102db80e7fc0a1700aa27101e212ea8a82b3329bb
SHA256c75cfea3da76ef6993a88b2dccd2ff8d09fc68d9fcc1f6b90444c603eadf0e0d
SHA512bbc0a6c27a9fb2c96fe8342d37bbbde59ce119ed67778fc592cceafaa3755a0d6f55249df2c05b9cf0673cfacf75e6d5ac99269215ff793be782e0412e11d493
-
Filesize
144KB
MD5640e288280c05fe5314a6e47ffc88ecb
SHA1193273a146b7f42d58c7d26147161744a1eaf6c2
SHA256c812f93769690a4b8aa7dfa716d9a3e913f360fd7caeea2e85de928ee65c20c4
SHA51229cd7a3b9ccd9ab50e1372136f579d9d1c890730b93489f83ce29a7b6b1422005bbbb4530533cf30b18ba16666d8b2db23c27e0b5ebd3fed6521abf685ced292
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd