Analysis
-
max time kernel
31s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
22-08-2023 21:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Spotify.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Spotify.exe
-
Size
1.7MB
-
MD5
937bd53a5f505b8e9b00416590ad8d92
-
SHA1
5abece11f9d282ec009bf441f132676344f1ede2
-
SHA256
662d56478c8fa24fb43b71cba64af8d941ddb90659c2412144b46137e2cc4c36
-
SHA512
2027fe14eff8cc0edd67be7f159e0710d79376aef11a70d4c0ad94d501667fd178780fb3a8f0c4481d2da32a3f6fd698e45cef297aee628cda1ae164e0434dd5
-
SSDEEP
49152:MXi87ZaoNcK9mVrSPYO1M+BrgdhwmzJnU:yvycBr
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
taskmgr.exepid process 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 4076 taskmgr.exe Token: SeSystemProfilePrivilege 4076 taskmgr.exe Token: SeCreateGlobalPrivilege 4076 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
taskmgr.exepid process 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
Processes:
taskmgr.exepid process 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe 4076 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spotify.exe"C:\Users\Admin\AppData\Local\Temp\Spotify.exe"1⤵PID:3880
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4076