6d192fbf295a7505ae7fdb872f12465b79931c7284ab21bc493bc3a118ae844b

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OBS-Studio-30.0.2-Full-Installer-x64.exe
Size

129.7MB
MD5

069b50c9ad5271d87b4fdd7827e77651
SHA1

caf23a0206d6ee60ba34c32e0f1ed67343d218f2
SHA256

6d192fbf295a7505ae7fdb872f12465b79931c7284ab21bc493bc3a118ae844b
SHA512

644d7de414b53dc9ca6c13a60612397fa27fda47112c008401a0a4dcdcf4beaab57737764cb3ae515ce97ebbcec3382aca0306e4e15145262346aba63b443a4c
SSDEEP

3145728:MtwJRWuE1gDI1F4Ojhevw+0renDKYiCzLAs+aqT7GrEeLoyNI5Xk:vJHE11jhq0rieY5zLAs+DTwEeLBe50

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3036	OBS-Studio-30.0.2-Full-Installer-x64.exe
3036	OBS-Studio-30.0.2-Full-Installer-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3036	OBS-Studio-30.0.2-Full-Installer-x64.exe

C:\Users\Admin\AppData\Local\Temp\OBS-Studio-30.0.2-Full-Installer-x64.exe
"C:\Users\Admin\AppData\Local\Temp\OBS-Studio-30.0.2-Full-Installer-x64.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsyC89E.tmp\ioSpecial.ini

Filesize
1KB

MD5
cd8c24a3efd0478d7a6198a7bc8c5223

SHA1
6de71250b9910b1c5c181af2e5525d821fabc799

SHA256
01bb97048bfc63a630a213adef6689868da4e3977f7181da34af128f22005bae

SHA512
6d4a3cbe89da39cd841a294df2dcd56ed94069d16344793a9f4988fe5871448d49fc2617684176471c2b8984bc3981764dea7802b76947208c1a22cf483fc2af

Download Submit
\Users\Admin\AppData\Local\Temp\nsyC89E.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit