6d192fbf295a7505ae7fdb872f12465b79931c7284ab21bc493bc3a118ae844b

Analysis

max time kernel
132s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OBS-Studio-30.0.2-Full-Installer-x64.exe
Size

129.7MB
MD5

069b50c9ad5271d87b4fdd7827e77651
SHA1

caf23a0206d6ee60ba34c32e0f1ed67343d218f2
SHA256

6d192fbf295a7505ae7fdb872f12465b79931c7284ab21bc493bc3a118ae844b
SHA512

644d7de414b53dc9ca6c13a60612397fa27fda47112c008401a0a4dcdcf4beaab57737764cb3ae515ce97ebbcec3382aca0306e4e15145262346aba63b443a4c
SSDEEP

3145728:MtwJRWuE1gDI1F4Ojhevw+0renDKYiCzLAs+aqT7GrEeLoyNI5Xk:vJHE11jhq0rieY5zLAs+DTwEeLBe50

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3008	OBS-Studio-30.0.2-Full-Installer-x64.exe
3008	OBS-Studio-30.0.2-Full-Installer-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\OBS-Studio-30.0.2-Full-Installer-x64.exe
"C:\Users\Admin\AppData\Local\Temp\OBS-Studio-30.0.2-Full-Installer-x64.exe"
1⤵
- Loads dropped DLL
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsxE699.tmp\InstallOptions.dll

Filesize
15KB

MD5
0a9fb96a7579b685ec36b17fc354e6a3

SHA1
355754104dd47d5fcf8918dee0dc2e2ee53390a6

SHA256
b34fb342f21d690aac024b6f48a597e78d15791ef480ac55159cd585d0f64af7

SHA512
67870206fa7f1e7df45c8c1bc2f51fb430f0a048a2bdb55a4a41525388ca3b50203784537f139169705a03db4bb13b591162a79a5d2df81a4d11fd849615c86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxE699.tmp\ioSpecial.ini

Filesize
1KB

MD5
d662b5ddedf0fbc1d5c886833149722b

SHA1
8b781e6ad57dd22ec41618b90f0f94afdf6a59f1

SHA256
1db6fdd0a219c7ebcda35116d4c15a2570de1dd5f0b89708e066946511374722

SHA512
19e43873d90c23f58ce3eda981fe92831ddfe7b54afc199289ca2d4025dc36c9deea2516cb9313dea09a6f9a5e5854c078ff43bfcb4d0a89c83ec7be2c01b3e6

Download Submit