0d9a8653e5518d5257e673acc67cca908e9da497b5e469fd26d35de659403ebd

Analysis

max time kernel
148s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2023 03:14

Target

Spotify 1.2.7.1264/App/Spotify/locales/ta.mo
Size

23KB
MD5

10881f9d05dbcce84d16224194aa4cf6
SHA1

702f15caffe3d9303d0dad0ff8531dfc5d33fca0
SHA256

5019a1f3ea90dbb5745e6adbe76e497e5ac2fcc98ff03423369e7aae3c468b36
SHA512

6c69a1b6b87b0db31023734c7319f8aeb8a3fd92d772808d8b2b8038fc7240a58460c202577cfdb59663c9e212666eac42b774d3f5fe2938e13a58e7559793df
SSDEEP

384:MRqeeZxdgNhA9ozOfBKr+c+Qp//nKAghRe183n:oqeqdzSQn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3064 OpenWith.exe

pid	process
3064	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Spotify 1.2.7.1264\App\Spotify\locales\ta.mo"
1⤵
- Modifies registry class
PID:3668

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact