Analysis
-
max time kernel
24s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
05-08-2024 13:10
General
-
Target
[@Spotify_Crack] Spotify Windows 1.2.40.599.exe
-
Size
147.0MB
-
MD5
aa2802aef5fc760ade30b32e5a0e2f84
-
SHA1
ef22244594b0c8a203d013e534372e8200c29444
-
SHA256
3fa746ce2a9b15a643a4204e29e289fb141b2e545c6303cfbfab2b3f9df1306a
-
SHA512
3764ebab8790f98a9099e756833ebb1b9145fd44dd5b89538265493e068d8d32b6b0455df1c9ff427fb472e801ed7b568f9e7d5e3df3a8af724ee944a4974dad
-
SSDEEP
3145728:SSh33Wxl70Cz2G8s08ZE+KbCDGaZAUEkyzJVx4V49V+esVwhRa:SSZ3WxlQHG8sPTKu+LJVx4V49VDsVSRa
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[@Spotify_Crack] Spotify Windows 1.2.40.599.exe"C:\Users\Admin\AppData\Local\Temp\[@Spotify_Crack] Spotify Windows 1.2.40.599.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-G72F9.tmp\[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp"C:\Users\Admin\AppData\Local\Temp\is-G72F9.tmp\[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp" /SL5="$400F8,153232342,730112,C:\Users\Admin\AppData\Local\Temp\[@Spotify_Crack] Spotify Windows 1.2.40.599.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /f /im Spotify.exe /t3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25.4MB
MD5f19f49c561ad66068ccff60ca02c5278
SHA12b29096f74ebc3bd6ebb2732c0fb7f9d64c38bad
SHA2569a54a9427f581875417d162005c1fadb41fc7c0aea147b3e5e9811b23a357c11
SHA512a2128b3ae99538cdd40e3eeeef14a9833f572efb936df4b4b11560861d703231bc21e6ce96f8e17caa438f3847020b8fd1a47d45badee4ee9bf669cd528a6e1d
-
Filesize
2.9MB
MD599919c06ff43ac970b68ee8fbd89a114
SHA1308f98052809e5dc743af5d8a1bf5a2da2462974
SHA256bd383709de2b2d349ee694759ea6ba29f5680c13bd7feec5872c67ba192eaee3
SHA5129a8f0a82ebc50729850b0398bd4dab7e91db9bf20e2ec06350d551b0f04d336b56c0d37e6fed90af998750a2f6a9a7d8fcc06a7923fee993d407996d4a010966
-
Filesize
25.6MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
672KB