5be7e227739f852689d1a0c7f4c42afe5e98a1090718e2374484a089da40479e

General

Target

Spotify-Premium-Tool.exe
Size

125KB
MD5

1605b8bb2146d4fc31a6a5719dd9b71e
SHA1

0791447a84d296bad87c622d07da0ba0a6f3f7f0
SHA256

5be7e227739f852689d1a0c7f4c42afe5e98a1090718e2374484a089da40479e
SHA512

aea4144158311e2800cc93dee9c60da2810460e23a783648ced3cda267baecb0299349e6ae808d245ff784bdd63ee47f1df3ed31ebadae2e1697415813ca1ddd
SSDEEP

3072:w/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSj6:Ltzsb5Uh28+V1WW69B9VjMdxPedN9ugu

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
13	540	powershell.exe
47	4712	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
13	raw.githubusercontent.com
47	raw.githubusercontent.com

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1912	timeout.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
540	powershell.exe
540	powershell.exe
4712	powershell.exe
4712	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2964	2372	Spotify-Premium-Tool.exe	85
PID 2372 wrote to memory of 2964	2372	Spotify-Premium-Tool.exe	85
PID 2964 wrote to memory of 1912	2964	cmd.exe	86
PID 2964 wrote to memory of 1912	2964	cmd.exe	86
PID 2964 wrote to memory of 540	2964	cmd.exe	88
PID 2964 wrote to memory of 540	2964	cmd.exe	88
PID 2964 wrote to memory of 4712	2964	cmd.exe	99
PID 2964 wrote to memory of 4712	2964	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\Spotify-Premium-Tool.exe
"C:\Users\Admin\AppData\Local\Temp\Spotify-Premium-Tool.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\98E4.tmp\98E5.tmp\98E6.bat C:\Users\Admin\AppData\Local\Temp\Spotify-Premium-Tool.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:1912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "iwr -useb https://raw.githubusercontent.com/spicetify/spicetify-cli/master/install.ps1 | iex"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "iwr -useb https://raw.githubusercontent.com/spicetify/spicetify-marketplace/main/resources/install.ps1 | iex"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e108f0cf9f26c978845bd9a68c096a71

SHA1
f3112b2d029e5294386f046c1ac9f872149e9b0c

SHA256
ecb120f110ae24720f456a6ddb76e49a4faed9d65db299fb703c5410d961415d

SHA512
b612d3d6c80743e9fce08585530a95476dba7a6cca0148414c157f62f763a3f4c96e0654b9f3e8d705e90c7dd25c41d53dab145f0d8fb9364c74a4ccadb000c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\98E4.tmp\98E5.tmp\98E6.bat

Filesize
562B

MD5
9423e62ec7ce49e17f8e96dc92ada37f

SHA1
4b1582bbedd5a270b2fd68b205776b61d0d5086d

SHA256
24a126397dabe9c1739f268ca2d87f85baceeef926a6b1b515fb0afcba4b8adb

SHA512
66527e9abaac8eb2a1c8d051d496c6f01d79fa00a23acbb767bd9e018dbe87dcd43b3608899a09b6e7df22282c2640ebe012abfd433edf56315de4e1ecbc1f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jbug5fzt.rny.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/540-17-0x00007FFE7DCA0000-0x00007FFE7E761000-memory.dmp

Filesize
10.8MB

Download
memory/540-14-0x000002DEE9480000-0x000002DEE9490000-memory.dmp

Filesize
64KB

Download
memory/540-13-0x000002DEE9480000-0x000002DEE9490000-memory.dmp

Filesize
64KB

Download
memory/540-12-0x00007FFE7DCA0000-0x00007FFE7E761000-memory.dmp

Filesize
10.8MB

Download
memory/540-8-0x000002DEE92B0000-0x000002DEE92D2000-memory.dmp

Filesize
136KB

Download
memory/4712-19-0x00007FFE7DCB0000-0x00007FFE7E771000-memory.dmp

Filesize
10.8MB

Download
memory/4712-20-0x000001AA273D0000-0x000001AA273E0000-memory.dmp

Filesize
64KB

Download
memory/4712-21-0x000001AA273D0000-0x000001AA273E0000-memory.dmp

Filesize
64KB

Download
memory/4712-32-0x000001AA273D0000-0x000001AA273E0000-memory.dmp

Filesize
64KB

Download
memory/4712-34-0x00007FFE7DCB0000-0x00007FFE7E771000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing