File name:

StudioOne_Keygen.exe

Full analysis: https://app.any.run/tasks/8b7f544a-2740-4810-9f7c-487e106b8d9f
Verdict: Malicious activity
Analysis date: March 17, 2024, 19:06:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

546975974D3F70B91E891028711F6C98

SHA1:

9F307F0F34CE24E868604CE42C0864D2C98EF2F0

SHA256:

FBCB9EF393A175B44E4AEC001B4260E004091413340697B66D80B957AE3CD7AC

SSDEEP:

49152:okAsIZ1wIAoJwcbjQBHPk5O9NPOX5SIFspul8Bh8HIm1XHcbfw:oXsqSIJwcYBYO9hOX5Swspueh8HIsyY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • StudioOne_Keygen.exe (PID: 2896)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • StudioOne_Keygen.exe (PID: 2896)

  • INFO

    • Checks supported languages

      • StudioOne_Keygen.exe (PID: 2896)
      • keygen.exe (PID: 3488)

    • Reads the computer name

      • keygen.exe (PID: 3488)
      • StudioOne_Keygen.exe (PID: 2896)

    • Manual execution by a user

      • notepad++.exe (PID: 3544)

    • Create files in a temporary directory

      • StudioOne_Keygen.exe (PID: 2896)
      • keygen.exe (PID: 3488)

    • Reads the machine GUID from the registry

      • keygen.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start studioone_keygen.exe keygen.exe no specs notepad++.exe studioone_keygen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1836"C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe" C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\studioone_keygen.exe
c:\windows\system32\ntdll.dll
2896"C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe" C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\studioone_keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3488C:\Users\admin\AppData\Local\Temp\keygen.exeC:\Users\admin\AppData\Local\Temp\keygen.exe—StudioOne_Keygen.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3544"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\mvp.studioone.atomicfuel.license"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 808
Read events
3 790
Write events
18
Delete events
0

Modification events

(PID) Process:(3488) keygen.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3544) notepad++.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
121
Text files
4
Unknown types
7

Dropped files

PID
Process
Filename
Type
2896StudioOne_Keygen.exeC:\Users\admin\AppData\Local\Temp\BASSMOD.dllexecutable
MD5:E4EC57E8508C5C4040383EBE6D367928
SHA256:8AD9E47693E292F381DA42DDC13724A3063040E51C26F4CA8E1F8E2F1DDD547F
2896StudioOne_Keygen.exeC:\Users\admin\AppData\Local\Temp\R2RS1KG2.dllexecutable
MD5:90F4D27517ACC223D1698E6D189861E9
SHA256:D53DB9201A4A0BA627F107739398BE8B16E8618D06FA88EED476026A43A4CC6E
2896StudioOne_Keygen.exeC:\Users\admin\AppData\Local\Temp\keygen.exeexecutable
MD5:53D7DA6A889DE0D0B5BEC3A2178C2F50
SHA256:6F860EA1F574AC8804FF1F63A7F1EF9CA30B759D07F94DBA42AC5A24F0956B8F
3488keygen.exeC:\Users\admin\Desktop\studioapp3.pro.licensebinary
MD5:0E30C9F0669ED9A2B570BF2B71981648
SHA256:BDAF7F7BECAEFF094FB4B641D9EA7793A86831019E5C78511A58D78FA732AF3A
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.afropop.licensebinary
MD5:232E57993F3C2B6A1A66536AB75ADB94
SHA256:3D7AE192DD4703172AB8447E987ADE9C0BE230A65586BE74600A6D49DE152DD0
3488keygen.exeC:\Users\admin\Desktop\studioapp6.pro.licensetext
MD5:5A16CFD4B31A745B40134FD4996CECA7
SHA256:903D41F8EBE1270CE452738998998BB27493F7A52B26715A8ED1300318495F30
3488keygen.exeC:\Users\admin\Desktop\studioapp2.pro.licensebinary
MD5:55B3E4CB0C8E29F5EE8D7D29988EEAC9
SHA256:7DE07066B4687B4D3759FA45AB2A731864C8C4DB63C6F4B4E9A24D28A623BE43
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.4forty.licensebinary
MD5:909A91AA55F3C0C354CF92CD434731F1
SHA256:806000EB1AF22E41953E426ACDC55267A00993A5DE579A05DCF43B2557EA3F73
3488keygen.exeC:\Users\admin\Desktop\mvp.studioone.atomicfuel.licensebinary
MD5:D789AE6C2712BF886159BAD517BB7D9C
SHA256:4E05D6568FA800C29C318B14021BCA45DDC664523A67F151E1C3D3D5B710907B
3488keygen.exeC:\Users\admin\Desktop\presonushub.licensebinary
MD5:1C374A43ABAC577A85C4AA243E983CF5
SHA256:6B1F590CDE321ED39E562A57BC282BFCEC9FF6B403CE45B9CE140613FF8F439F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
StudioOne_Keygen.exe