Analysis

  • max time kernel
    58s
  • max time network
    72s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-03-2024 12:39

General

  • Target

    Obs_VcamGUI.exe

  • Size

    140.5MB

  • MD5

    04d6abf89ad6168731259ee31a1e11b0

  • SHA1

    5f473fe5428a3dd028f7ac3f3623b61ce760ec01

  • SHA256

    40459ec37e818f0d50d385a24dfc0c0542865c4d4a893ea1d02502bce3e788a8

  • SHA512

    bbcd4b95456ec2d26b0234b96eb4ee8539fbf011d42a6dd88f432d37258c6dee047ba88b8edd856c715afc763d9065369aa8fc7ad74289fd5970e7518bc59660

  • SSDEEP

    786432:O0CQFo/Mnm6jKS6mI72RAZzVQ/T5v7pI1TtLwSTRpf4P1wT1Wyzqenai6:OIFNnuYuBIT5TpKdai6

Score
1/10

Malware Config

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Obs_VcamGUI.exe
    "C:\Users\Admin\AppData\Local\Temp\Obs_VcamGUI.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:436
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3944 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:5104

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/436-0-0x0000000180000000-0x0000000180A20000-memory.dmp

      Filesize

      10.1MB

    • memory/436-3-0x00000223D5240000-0x00000223D54E7000-memory.dmp

      Filesize

      2.7MB

    • memory/436-5-0x00007FF7D0500000-0x00007FF7D0E56000-memory.dmp

      Filesize

      9.3MB

    • memory/436-7-0x00000223D61B0000-0x00000223D6E61000-memory.dmp

      Filesize

      12.7MB

    • memory/436-10-0x00000223B4820000-0x00000223B4832000-memory.dmp

      Filesize

      72KB

    • memory/436-13-0x00000223D50E0000-0x00000223D51A1000-memory.dmp

      Filesize

      772KB

    • memory/436-16-0x00000223B4810000-0x00000223B481D000-memory.dmp

      Filesize

      52KB

    • memory/436-19-0x00000223B4880000-0x00000223B48A0000-memory.dmp

      Filesize

      128KB

    • memory/436-22-0x00000223B48A0000-0x00000223B48B8000-memory.dmp

      Filesize

      96KB

    • memory/436-25-0x00000223D4F90000-0x00000223D4FA3000-memory.dmp

      Filesize

      76KB

    • memory/436-31-0x00000223D5010000-0x00000223D5031000-memory.dmp

      Filesize

      132KB

    • memory/436-34-0x00000223D5040000-0x00000223D5080000-memory.dmp

      Filesize

      256KB

    • memory/436-37-0x00000223D5600000-0x00000223D56FE000-memory.dmp

      Filesize

      1016KB

    • memory/436-40-0x00000223B4850000-0x00000223B4857000-memory.dmp

      Filesize

      28KB

    • memory/436-43-0x00000223D4FF0000-0x00000223D4FFA000-memory.dmp

      Filesize

      40KB

    • memory/436-46-0x00000223D51B0000-0x00000223D51C6000-memory.dmp

      Filesize

      88KB

    • memory/436-49-0x00000223D57C0000-0x00000223D5875000-memory.dmp

      Filesize

      724KB

    • memory/436-52-0x00000223D55E0000-0x00000223D55FD000-memory.dmp

      Filesize

      116KB

    • memory/436-55-0x00000223D5790000-0x00000223D57BA000-memory.dmp

      Filesize

      168KB

    • memory/436-58-0x00000223D5220000-0x00000223D5236000-memory.dmp

      Filesize

      88KB

    • memory/436-61-0x00000223DB320000-0x00000223DB3A2000-memory.dmp

      Filesize

      520KB

    • memory/436-64-0x00000223D5A30000-0x00000223D5A35000-memory.dmp

      Filesize

      20KB

    • memory/436-67-0x00000223D5510000-0x00000223D5526000-memory.dmp

      Filesize

      88KB

    • memory/436-82-0x00007FF7D0500000-0x00007FF7D0E56000-memory.dmp

      Filesize

      9.3MB

    • memory/436-83-0x00007FF7D0500000-0x00007FF7D0E56000-memory.dmp

      Filesize

      9.3MB