cb5b534f0189a845cb43ea11408e4390f3b036d447c3ceedd337c2c88af0cc4c

General

Target

Spotify Premium/Setup.exe
Size

630.2MB
MD5

32a4d0a4ab16a702c4a00b41a6d1377e
SHA1

cf9935a37c5477fdd991f50078d0fbe0da51f8df
SHA256

6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf
SHA512

c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf
SSDEEP

6144:TfbOrBANQk+LQ9JfIzgPO6gsURuloFxdPQ:MO//AzgmuqO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Setup.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 1 IoCs

Processes:

oneetx.exe

pid process

5072 oneetx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5072	oneetx.exe

Program crash 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2812	400	WerFault.exe	Setup.exe
4776	400	WerFault.exe	Setup.exe
456	400	WerFault.exe	Setup.exe
4620	400	WerFault.exe	Setup.exe
3908	400	WerFault.exe	Setup.exe
4560	400	WerFault.exe	Setup.exe
2584	400	WerFault.exe	Setup.exe
2280	400	WerFault.exe	Setup.exe
4828	400	WerFault.exe	Setup.exe
432	400	WerFault.exe	Setup.exe
4780	400	WerFault.exe	Setup.exe
1432	400	WerFault.exe	Setup.exe
668	400	WerFault.exe	Setup.exe
4852	400	WerFault.exe	Setup.exe
4960	5072	WerFault.exe	oneetx.exe
2760	5072	WerFault.exe	oneetx.exe
3696	5072	WerFault.exe	oneetx.exe
3976	5072	WerFault.exe	oneetx.exe
5104	5072	WerFault.exe	oneetx.exe
4140	5072	WerFault.exe	oneetx.exe
4920	5072	WerFault.exe	oneetx.exe
4812	5072	WerFault.exe	oneetx.exe
1084	5072	WerFault.exe	oneetx.exe
1976	5072	WerFault.exe	oneetx.exe
2280	5072	WerFault.exe	oneetx.exe
4756	5072	WerFault.exe	oneetx.exe
5020	5072	WerFault.exe	oneetx.exe
4452	5072	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1932 schtasks.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Setup.exe

pid process

400 Setup.exe

pid	process
1932	schtasks.exe

pid	process
400	Setup.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

Setup.exeoneetx.execmd.exe

description	pid	process	target process
PID 400 wrote to memory of 5072	400	Setup.exe	oneetx.exe
PID 400 wrote to memory of 5072	400	Setup.exe	oneetx.exe
PID 400 wrote to memory of 5072	400	Setup.exe	oneetx.exe
PID 5072 wrote to memory of 1932	5072	oneetx.exe	schtasks.exe
PID 5072 wrote to memory of 1932	5072	oneetx.exe	schtasks.exe
PID 5072 wrote to memory of 1932	5072	oneetx.exe	schtasks.exe
PID 5072 wrote to memory of 4604	5072	oneetx.exe	cmd.exe
PID 5072 wrote to memory of 4604	5072	oneetx.exe	cmd.exe
PID 5072 wrote to memory of 4604	5072	oneetx.exe	cmd.exe
PID 4604 wrote to memory of 2248	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 2248	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 2248	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 2572	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 2572	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 2572	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 4044	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 4044	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 4044	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 4220	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 4220	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 4220	4604	cmd.exe	cmd.exe
PID 4604 wrote to memory of 4112	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 4112	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 4112	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 3456	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 3456	4604	cmd.exe	cacls.exe
PID 4604 wrote to memory of 3456	4604	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 732
2⤵
- Program crash
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 828
2⤵
- Program crash
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 880
2⤵
- Program crash
PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 888
2⤵
- Program crash
PID:4620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 988
2⤵
- Program crash
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 988
2⤵
- Program crash
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1232
2⤵
- Program crash
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1244
2⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1284
2⤵
- Program crash
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1360
2⤵
- Program crash
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1004
2⤵
- Program crash
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 972
2⤵
- Program crash
PID:1432

C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 584
3⤵
- Program crash
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 724
3⤵
- Program crash
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 732
3⤵
- Program crash
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 792
3⤵
- Program crash
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 760
3⤵
- Program crash
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 708
3⤵
- Program crash
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 980
3⤵
- Program crash
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 988
3⤵
- Program crash
PID:4812

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe" /F
3⤵
- Creates scheduled task(s)
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 920
3⤵
- Program crash
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1200
3⤵
- Program crash
PID:1976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\23e20ad4db" /P "Admin:N"&&CACLS "..\23e20ad4db" /P "Admin:R" /E&&Exit
3⤵
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:2248

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:N"
4⤵
PID:2572

C:\Windows\SysWOW64\cacls.exe
CACLS "oneetx.exe" /P "Admin:R" /E
4⤵
PID:4044

C:\Windows\SysWOW64\cacls.exe
CACLS "..\23e20ad4db" /P "Admin:N"
4⤵
PID:4112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
4⤵
PID:4220

C:\Windows\SysWOW64\cacls.exe
CACLS "..\23e20ad4db" /P "Admin:R" /E
4⤵
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1240
3⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 668
3⤵
- Program crash
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1188
3⤵
- Program crash
PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1496
3⤵
- Program crash
PID:4452

C:\Users\Admin\AppData\Local\Temp\1000001001\gookcom.exe
"C:\Users\Admin\AppData\Local\Temp\1000001001\gookcom.exe"
3⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 920
2⤵
- Program crash
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1428
2⤵
- Program crash
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 400 -ip 400
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 400 -ip 400
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 400 -ip 400
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 400 -ip 400
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 400 -ip 400
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 400 -ip 400
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 400 -ip 400
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 400 -ip 400
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 400 -ip 400
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5072 -ip 5072
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5072 -ip 5072
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5072 -ip 5072
1⤵
PID:504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5072 -ip 5072
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5072 -ip 5072
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5072 -ip 5072
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5072 -ip 5072
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5072 -ip 5072
1⤵
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5072 -ip 5072
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5072 -ip 5072
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5072 -ip 5072
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5072 -ip 5072
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5072 -ip 5072
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5072 -ip 5072
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5072 -ip 5072
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000001001\gookcom.exe
Filesize
769KB

MD5
c6fea3621cca858371f2d596c9723891

SHA1
48a23b6c768a4a4f8ba2864159f959c0e025f08a

SHA256
0a4d7ed03798e5257a21afc76553e538486316389bd54c9b9bcc03699ae21cd3

SHA512
c3c7973b774c9cbe0888ebf4858b617a4431cb614a38d260ebefa3717ee932ccb0e93a14159aa6856aa0094e13627a1c8a071fdfff3639f5b14194af3a3d1bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
Filesize
630.2MB

MD5
32a4d0a4ab16a702c4a00b41a6d1377e

SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df

SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf

SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
Filesize
630.2MB

MD5
32a4d0a4ab16a702c4a00b41a6d1377e

SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df

SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf

SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
Filesize
630.2MB

MD5
32a4d0a4ab16a702c4a00b41a6d1377e

SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df

SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf

SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf

Download Submit
memory/400-134-0x0000000002C80000-0x0000000002CB3000-memory.dmp

Filesize
204KB

Download
memory/400-135-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/400-143-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/400-149-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/5072-150-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/5072-161-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads