0d9a8653e5518d5257e673acc67cca908e9da497b5e469fd26d35de659403ebd

Analysis

max time kernel
158s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25-03-2023 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify 1.2.7.1264/App/Spotify/locales/ta.mo
Size

23KB
MD5

10881f9d05dbcce84d16224194aa4cf6
SHA1

702f15caffe3d9303d0dad0ff8531dfc5d33fca0
SHA256

5019a1f3ea90dbb5745e6adbe76e497e5ac2fcc98ff03423369e7aae3c468b36
SHA512

6c69a1b6b87b0db31023734c7319f8aeb8a3fd92d772808d8b2b8038fc7240a58460c202577cfdb59663c9e212666eac42b774d3f5fe2938e13a58e7559793df
SSDEEP

384:MRqeeZxdgNhA9ozOfBKr+c+Qp//nKAghRe183n:oqeqdzSQn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.mo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\mo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.mo\ = "mo_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

1856 AcroRd32.exe
1856 AcroRd32.exe

pid	process
1856	AcroRd32.exe
1856	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1480	2028	cmd.exe	rundll32.exe
PID 2028 wrote to memory of 1480	2028	cmd.exe	rundll32.exe
PID 2028 wrote to memory of 1480	2028	cmd.exe	rundll32.exe
PID 1480 wrote to memory of 1856	1480	rundll32.exe	AcroRd32.exe
PID 1480 wrote to memory of 1856	1480	rundll32.exe	AcroRd32.exe
PID 1480 wrote to memory of 1856	1480	rundll32.exe	AcroRd32.exe
PID 1480 wrote to memory of 1856	1480	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Spotify 1.2.7.1264\App\Spotify\locales\ta.mo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Spotify 1.2.7.1264\App\Spotify\locales\ta.mo
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1480

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Spotify 1.2.7.1264\App\Spotify\locales\ta.mo"
3⤵
- Suspicious use of SetWindowsHookEx
PID:1856

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads