Overview
overview
7Static
static
3OBS-Studio...64.exe
windows7-x64
7OBS-Studio...64.exe
windows10-2004-x64
7data/obs-p...ext.py
windows7-x64
3data/obs-p...ext.py
windows10-2004-x64
3data/obs-p...r.html
windows7-x64
1data/obs-p...r.html
windows10-2004-x64
1obs-plugin...ja.dll
windows7-x64
1obs-plugin...ja.dll
windows10-2004-x64
1obs-plugin...lf.dll
windows7-x64
1obs-plugin...lf.dll
windows10-2004-x64
1obs-plugin...er.dll
windows7-x64
1obs-plugin...er.dll
windows10-2004-x64
1obs-plugin...ns.dll
windows7-x64
1obs-plugin...ns.dll
windows10-2004-x64
1obs-plugin...ui.dll
windows7-x64
1obs-plugin...ui.dll
windows10-2004-x64
1obs-plugin...nk.dll
windows7-x64
1obs-plugin...nk.dll
windows10-2004-x64
1obs-plugin...ls.dll
windows7-x64
1obs-plugin...ls.dll
windows10-2004-x64
1obs-plugin...ce.dll
windows7-x64
1obs-plugin...ce.dll
windows10-2004-x64
1obs-plugin...GL.dll
windows7-x64
1obs-plugin...GL.dll
windows10-2004-x64
1obs-plugin...v2.dll
windows7-x64
1obs-plugin...v2.dll
windows10-2004-x64
1obs-plugin...ef.dll
windows7-x64
1obs-plugin...ef.dll
windows10-2004-x64
1obs-plugin...ge.exe
windows7-x64
1obs-plugin...ge.exe
windows10-2004-x64
1obs-plugin...er.dll
windows7-x64
1obs-plugin...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 14:38
Static task
static1
Behavioral task
behavioral1
Sample
OBS-Studio-30.0.2-Full-Installer-x64.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
OBS-Studio-30.0.2-Full-Installer-x64.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
data/obs-plugins/frontend-tools/scripts/url-text.py
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
data/obs-plugins/frontend-tools/scripts/url-text.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
data/obs-plugins/obs-browser/error.html
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
data/obs-plugins/obs-browser/error.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
obs-plugins/64bit/aja.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
obs-plugins/64bit/aja.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
obs-plugins/64bit/chrome_elf.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
obs-plugins/64bit/chrome_elf.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
obs-plugins/64bit/coreaudio-encoder.dll
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
obs-plugins/64bit/coreaudio-encoder.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
obs-plugins/64bit/decklink-captions.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
obs-plugins/64bit/decklink-captions.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
obs-plugins/64bit/decklink-output-ui.dll
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
obs-plugins/64bit/decklink-output-ui.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
obs-plugins/64bit/decklink.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
obs-plugins/64bit/decklink.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
obs-plugins/64bit/frontend-tools.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
obs-plugins/64bit/frontend-tools.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
obs-plugins/64bit/image-source.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
obs-plugins/64bit/image-source.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
obs-plugins/64bit/libEGL.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
obs-plugins/64bit/libEGL.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
obs-plugins/64bit/libGLESv2.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
obs-plugins/64bit/libGLESv2.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
obs-plugins/64bit/libcef.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
obs-plugins/64bit/libcef.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
obs-plugins/64bit/obs-browser-page.exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
obs-plugins/64bit/obs-browser-page.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
obs-plugins/64bit/obs-browser.dll
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
obs-plugins/64bit/obs-browser.dll
Resource
win10v2004-20231215-en
General
-
Target
data/obs-plugins/frontend-tools/scripts/url-text.py
-
Size
2KB
-
MD5
982319dc7736f0a7f753cdec07051cf9
-
SHA1
4f86b3f856a518b0ae9ab0e70895d55074a2057c
-
SHA256
178aafd7c5c2188fc509805c4651ba248b2c55b26aaecb2ac445e5477bf4e2f3
-
SHA512
2d15b74d6c53ec5eae4f4983ea35379c1c5781d2ca7280320114a166b181742e60c9e68acf6991f30b4a0f6c9e7afbde7b7c62cd132207450c39b95e4def401f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2624 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2624 AcroRd32.exe 2624 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2060 2688 cmd.exe 31 PID 2688 wrote to memory of 2060 2688 cmd.exe 31 PID 2688 wrote to memory of 2060 2688 cmd.exe 31 PID 2060 wrote to memory of 2624 2060 rundll32.exe 32 PID 2060 wrote to memory of 2624 2060 rundll32.exe 32 PID 2060 wrote to memory of 2624 2060 rundll32.exe 32 PID 2060 wrote to memory of 2624 2060 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\data\obs-plugins\frontend-tools\scripts\url-text.py1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\data\obs-plugins\frontend-tools\scripts\url-text.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\data\obs-plugins\frontend-tools\scripts\url-text.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2624
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5c57abf3266484877a2f7e5fad2b22b43
SHA1673f343d8c6411b0a1b83c53b1866f17760cb6cc
SHA256289a6d9dbb697faca140f1b11a914b94df28344d605915f43531b7e6eace47c6
SHA5125d5f59dc7c20db20af0d99aab225ff5b86ce2381efa3f907d46e4ed6b768ec3bb799572e80fe7fff9ebfcc2613c2954ca894bad5c72ac152c21a6fc4034a8ed0