fa7ff9975dce1fc26987f6457ee9ef5e9a9fbe4d21b68a34941343f5cb00651e

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 02:09

Target

Spotify_Premium.bat
Size

277B
MD5

bf78a0583ee16de7cf3776c7c7ad23fc
SHA1

30d6cf358f8932007554e5a5ef2f3ccf83c90e8a
SHA256

fa7ff9975dce1fc26987f6457ee9ef5e9a9fbe4d21b68a34941343f5cb00651e
SHA512

8a154d83996fbf0ba5f3c13514c48484824238d5d42aa7bcb44e399b996c249b66edaf722080101db0a7b4e8b93ca6028ac27ef565b9dfc7169d62466cf8f5ab

Score

1^/10

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2204	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2204	1044	cmd.exe	29
PID 1044 wrote to memory of 2204	1044	cmd.exe	29
PID 1044 wrote to memory of 2204	1044	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Spotify_Premium.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "&{[Net.ServicePointManager]::SecurityProtocol = 3072}; """"& { $(Invoke-WebRequest -UseBasicParsing 'https://spotx-official.github.io/run.ps1')} -new_theme """" | Invoke-Expression"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2204

memory/2204-4-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

Filesize
2.9MB

Download
memory/2204-5-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/2204-6-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2204-7-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2204-8-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2204-9-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2204-10-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download
memory/2204-11-0x0000000002580000-0x0000000002600000-memory.dmp

Filesize
512KB

Download
memory/2204-12-0x000007FEF6010000-0x000007FEF69AD000-memory.dmp

Filesize
9.6MB

Download