cb5b534f0189a845cb43ea11408e4390f3b036d447c3ceedd337c2c88af0cc4c

Analysis

max time kernel
155s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-04-2023 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spotify Premium/Setup.exe
Size

630.2MB
MD5

32a4d0a4ab16a702c4a00b41a6d1377e
SHA1

cf9935a37c5477fdd991f50078d0fbe0da51f8df
SHA256

6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf
SHA512

c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf
SSDEEP

6144:TfbOrBANQk+LQ9JfIzgPO6gsURuloFxdPQ:MO//AzgmuqO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 1 IoCs

pid	Process
5072	oneetx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 28 IoCs

pid	pid_target	Process	procid_target
2812	400	WerFault.exe	85
4776	400	WerFault.exe	85
456	400	WerFault.exe	85
4620	400	WerFault.exe	85
3908	400	WerFault.exe	85
4560	400	WerFault.exe	85
2584	400	WerFault.exe	85
2280	400	WerFault.exe	85
4828	400	WerFault.exe	85
432	400	WerFault.exe	85
4780	400	WerFault.exe	85
1432	400	WerFault.exe	85
668	400	WerFault.exe	85
4852	400	WerFault.exe	85
4960	5072	WerFault.exe	115
2760	5072	WerFault.exe	115
3696	5072	WerFault.exe	115
3976	5072	WerFault.exe	115
5104	5072	WerFault.exe	115
4140	5072	WerFault.exe	115
4920	5072	WerFault.exe	115
4812	5072	WerFault.exe	115
1084	5072	WerFault.exe	115
1976	5072	WerFault.exe	115
2280	5072	WerFault.exe	115
4756	5072	WerFault.exe	115
5020	5072	WerFault.exe	115
4452	5072	WerFault.exe	115

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1932	schtasks.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
400	Setup.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 5072	400	Setup.exe	115
PID 400 wrote to memory of 5072	400	Setup.exe	115
PID 400 wrote to memory of 5072	400	Setup.exe	115
PID 5072 wrote to memory of 1932	5072	oneetx.exe	135
PID 5072 wrote to memory of 1932	5072	oneetx.exe	135
PID 5072 wrote to memory of 1932	5072	oneetx.exe	135
PID 5072 wrote to memory of 4604	5072	oneetx.exe	141
PID 5072 wrote to memory of 4604	5072	oneetx.exe	141
PID 5072 wrote to memory of 4604	5072	oneetx.exe	141
PID 4604 wrote to memory of 2248	4604	cmd.exe	144
PID 4604 wrote to memory of 2248	4604	cmd.exe	144
PID 4604 wrote to memory of 2248	4604	cmd.exe	144
PID 4604 wrote to memory of 2572	4604	cmd.exe	146
PID 4604 wrote to memory of 2572	4604	cmd.exe	146
PID 4604 wrote to memory of 2572	4604	cmd.exe	146
PID 4604 wrote to memory of 4044	4604	cmd.exe	147
PID 4604 wrote to memory of 4044	4604	cmd.exe	147
PID 4604 wrote to memory of 4044	4604	cmd.exe	147
PID 4604 wrote to memory of 4220	4604	cmd.exe	149
PID 4604 wrote to memory of 4220	4604	cmd.exe	149
PID 4604 wrote to memory of 4220	4604	cmd.exe	149
PID 4604 wrote to memory of 4112	4604	cmd.exe	148
PID 4604 wrote to memory of 4112	4604	cmd.exe	148
PID 4604 wrote to memory of 4112	4604	cmd.exe	148
PID 4604 wrote to memory of 3456	4604	cmd.exe	150
PID 4604 wrote to memory of 3456	4604	cmd.exe	150
PID 4604 wrote to memory of 3456	4604	cmd.exe	150

C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify Premium\Setup.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 732
  2⤵
  - Program crash
  PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 828
  2⤵
  - Program crash
  PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 880
  2⤵
  - Program crash
  PID:456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 888
  2⤵
  - Program crash
  PID:4620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 988
  2⤵
  - Program crash
  PID:3908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 988
  2⤵
  - Program crash
  PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1232
  2⤵
  - Program crash
  PID:2584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1244
  2⤵
  - Program crash
  PID:2280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1284
  2⤵
  - Program crash
  PID:4828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1360
  2⤵
  - Program crash
  PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1004
  2⤵
  - Program crash
  PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 972
  2⤵
  - Program crash
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 584
    3⤵
    - Program crash
    PID:4960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 724
    3⤵
    - Program crash
    PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 732
    3⤵
    - Program crash
    PID:3696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 792
    3⤵
    - Program crash
    PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 760
    3⤵
    - Program crash
    PID:5104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 708
    3⤵
    - Program crash
    PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 980
    3⤵
    - Program crash
    PID:4920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 988
    3⤵
    - Program crash
    PID:4812
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 920
    3⤵
    - Program crash
    PID:1084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1200
    3⤵
    - Program crash
    PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\23e20ad4db" /P "Admin:N"&&CACLS "..\23e20ad4db" /P "Admin:R" /E&&Exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:2572
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:4044
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\23e20ad4db" /P "Admin:N"
      4⤵
      PID:4112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:4220
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\23e20ad4db" /P "Admin:R" /E
      4⤵
      PID:3456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1240
    3⤵
    - Program crash
    PID:2280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 668
    3⤵
    - Program crash
    PID:4756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1188
    3⤵
    - Program crash
    PID:5020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 1496
    3⤵
    - Program crash
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\1000001001\gookcom.exe
    "C:\Users\Admin\AppData\Local\Temp\1000001001\gookcom.exe"
    3⤵
    PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 920
  2⤵
  - Program crash
  PID:668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1428
  2⤵
  - Program crash
  PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 400 -ip 400
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 400 -ip 400
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 400 -ip 400
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 400 -ip 400
1⤵
PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 400 -ip 400
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 400 -ip 400
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 400 -ip 400
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 400 -ip 400
1⤵
PID:2480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 400 -ip 400
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 400
1⤵
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5072 -ip 5072
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5072 -ip 5072
1⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5072 -ip 5072
1⤵
PID:504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5072 -ip 5072
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5072 -ip 5072
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5072 -ip 5072
1⤵
PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5072 -ip 5072
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5072 -ip 5072
1⤵
PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5072 -ip 5072
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5072 -ip 5072
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5072 -ip 5072
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5072 -ip 5072
1⤵
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5072 -ip 5072
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5072 -ip 5072
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5072 -ip 5072
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000001001\gookcom.exe

Filesize
769KB

MD5
c6fea3621cca858371f2d596c9723891

SHA1
48a23b6c768a4a4f8ba2864159f959c0e025f08a

SHA256
0a4d7ed03798e5257a21afc76553e538486316389bd54c9b9bcc03699ae21cd3

SHA512
c3c7973b774c9cbe0888ebf4858b617a4431cb614a38d260ebefa3717ee932ccb0e93a14159aa6856aa0094e13627a1c8a071fdfff3639f5b14194af3a3d1bf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe

Filesize
630.2MB

MD5
32a4d0a4ab16a702c4a00b41a6d1377e

SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df

SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf

SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe

Filesize
630.2MB

MD5
32a4d0a4ab16a702c4a00b41a6d1377e

SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df

SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf

SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\23e20ad4db\oneetx.exe

Filesize
630.2MB

MD5
32a4d0a4ab16a702c4a00b41a6d1377e

SHA1
cf9935a37c5477fdd991f50078d0fbe0da51f8df

SHA256
6f895cd89dafd39df80e6cc7660f229e775c962ff249f56c9693ac16821cb9cf

SHA512
c6a327e8d33fbcabba45fe3a10572d5632b3addc094010f39a709cdb3367004b659f05954988c8ee6c87196790f84a77be1c4813bd2ce8174cdd74f9a4d36ebf

Download Submit
memory/400-134-0x0000000002C80000-0x0000000002CB3000-memory.dmp

Filesize
204KB

Download
memory/400-135-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/400-143-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/400-149-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/5072-150-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download
memory/5072-161-0x0000000000400000-0x0000000002BA9000-memory.dmp

Filesize
39.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads