File name:

StudioOne_Keygen.exe

Full analysis: https://app.any.run/tasks/8b7f544a-2740-4810-9f7c-487e106b8d9f
Verdict: Malicious activity
Analysis date: March 17, 2024, 19:06:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

546975974D3F70B91E891028711F6C98

SHA1:

9F307F0F34CE24E868604CE42C0864D2C98EF2F0

SHA256:

FBCB9EF393A175B44E4AEC001B4260E004091413340697B66D80B957AE3CD7AC

SSDEEP:

49152:okAsIZ1wIAoJwcbjQBHPk5O9NPOX5SIFspul8Bh8HIm1XHcbfw:oXsqSIJwcYBYO9hOX5Swspueh8HIsyY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • StudioOne_Keygen.exe (PID: 2896)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • StudioOne_Keygen.exe (PID: 2896)

  • INFO

    • Checks supported languages

      • StudioOne_Keygen.exe (PID: 2896)
      • keygen.exe (PID: 3488)

    • Reads the computer name

      • StudioOne_Keygen.exe (PID: 2896)
      • keygen.exe (PID: 3488)

    • Create files in a temporary directory

      • StudioOne_Keygen.exe (PID: 2896)
      • keygen.exe (PID: 3488)

    • Reads the machine GUID from the registry

      • keygen.exe (PID: 3488)

    • Manual execution by a user

      • notepad++.exe (PID: 3544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start studioone_keygen.exe keygen.exe no specs notepad++.exe studioone_keygen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1836"C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe" C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\studioone_keygen.exe
c:\windows\system32\ntdll.dll
2896"C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe" C:\Users\admin\AppData\Local\Temp\StudioOne_Keygen.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\studioone_keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3488C:\Users\admin\AppData\Local\Temp\keygen.exeC:\Users\admin\AppData\Local\Temp\keygen.exe—StudioOne_Keygen.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3544"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\mvp.studioone.atomicfuel.license"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 808
Read events
3 790
Write events
18
Delete events
0

Modification events

(PID) Process:(3488) keygen.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3544) notepad++.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
121
Text files
4
Unknown types
7

Dropped files

PID
Process
Filename
Type
2896StudioOne_Keygen.exeC:\Users\admin\AppData\Local\Temp\R2RS1KG2.dllexecutable
MD5:90F4D27517ACC223D1698E6D189861E9
SHA256:D53DB9201A4A0BA627F107739398BE8B16E8618D06FA88EED476026A43A4CC6E
2896StudioOne_Keygen.exeC:\Users\admin\AppData\Local\Temp\BASSMOD.dllexecutable
MD5:E4EC57E8508C5C4040383EBE6D367928
SHA256:8AD9E47693E292F381DA42DDC13724A3063040E51C26F4CA8E1F8E2F1DDD547F
2896StudioOne_Keygen.exeC:\Users\admin\AppData\Local\Temp\bgm.xmbinary
MD5:6D0A27BFAA520C9CBE3807FAB1F7DCE4
SHA256:44B9FE8532CA48D6E6087BE588EC3CD8CEA15FC93B08192C7FB8D151740326A1
3488keygen.exeC:\Users\admin\Desktop\studioapp2.pro.licensebinary
MD5:55B3E4CB0C8E29F5EE8D7D29988EEAC9
SHA256:7DE07066B4687B4D3759FA45AB2A731864C8C4DB63C6F4B4E9A24D28A623BE43
3488keygen.exeC:\Users\admin\Desktop\studioapp3.pro.licensebinary
MD5:0E30C9F0669ED9A2B570BF2B71981648
SHA256:BDAF7F7BECAEFF094FB4B641D9EA7793A86831019E5C78511A58D78FA732AF3A
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.coredrumkitsvol1.licensebinary
MD5:A297687B9F04CD49DF924B69841F63C8
SHA256:8EB7A93FB00F1E23CD15EDEBE88B28EAACB8A2B397AF2E59CFB34DF082C77F15
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.darkmoon.licensebinary
MD5:457DE5744682E2BB09E7195C4ED464B0
SHA256:E01A0C02F072E04ADDFD0C84DB8E315A4ADEC5635A147C947DFD37D6A08B7E63
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.drip.licensebinary
MD5:41099AADC8E54CACB08E3FF30ACDD995
SHA256:DE243931FA0E785FD1B5B0D629FBFBCDC9D8690D2726FE3E95DB3693A007C279
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.dream.licensebinary
MD5:5880752C09CB956770A9B7D8EE3FFD69
SHA256:9A6ADC23D08A2A742461347D1F299EA1673D39EB7439C1E126D2FD5A7C48BAEE
3488keygen.exeC:\Users\admin\Desktop\mvploops.studioone.feelings.licensebinary
MD5:4A012E492F511FBDF1E046A162B4A54B
SHA256:CD96CA36C1F9646211354CE868B4AE5E442608E95AEA638E64AAECC41E18B8D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
StudioOne_Keygen.exe