3fa746ce2a9b15a643a4204e29e289fb141b2e545c6303cfbfab2b3f9df1306a

Resubmissions

05-08-2024 13:13

240805-qf6tfaxamr 7

05-08-2024 13:10

240805-qejmhsxajq 7

Analysis

max time kernel
142s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[@Spotify_Crack] Spotify Windows 1.2.40.599.exe
Size

147.0MB
MD5

aa2802aef5fc760ade30b32e5a0e2f84
SHA1

ef22244594b0c8a203d013e534372e8200c29444
SHA256

3fa746ce2a9b15a643a4204e29e289fb141b2e545c6303cfbfab2b3f9df1306a
SHA512

3764ebab8790f98a9099e756833ebb1b9145fd44dd5b89538265493e068d8d32b6b0455df1c9ff427fb472e801ed7b568f9e7d5e3df3a8af724ee944a4974dad
SSDEEP

3145728:SSh33Wxl70Cz2G8s08ZE+KbCDGaZAUEkyzJVx4V49V+esVwhRa:SSZ3WxlQHG8sPTKu+LJVx4V49VDsVSRa

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
716	[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[@Spotify_Crack] Spotify Windows 1.2.40.599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3028	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 716	4784	[@Spotify_Crack] Spotify Windows 1.2.40.599.exe	88
PID 4784 wrote to memory of 716	4784	[@Spotify_Crack] Spotify Windows 1.2.40.599.exe	88
PID 4784 wrote to memory of 716	4784	[@Spotify_Crack] Spotify Windows 1.2.40.599.exe	88
PID 716 wrote to memory of 3028	716	[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp	89
PID 716 wrote to memory of 3028	716	[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp	89
PID 716 wrote to memory of 3028	716	[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp	89

C:\Users\Admin\AppData\Local\Temp\[@Spotify_Crack] Spotify Windows 1.2.40.599.exe
"C:\Users\Admin\AppData\Local\Temp\[@Spotify_Crack] Spotify Windows 1.2.40.599.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\is-5OLAF.tmp\[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5OLAF.tmp\[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp" /SL5="$401FA,153232342,730112,C:\Users\Admin\AppData\Local\Temp\[@Spotify_Crack] Spotify Windows 1.2.40.599.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /f /im Spotify.exe /t
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-5OLAF.tmp\[@Spotify_Crack] Spotify Windows 1.2.40.599.tmp

Filesize
2.9MB

MD5
99919c06ff43ac970b68ee8fbd89a114

SHA1
308f98052809e5dc743af5d8a1bf5a2da2462974

SHA256
bd383709de2b2d349ee694759ea6ba29f5680c13bd7feec5872c67ba192eaee3

SHA512
9a8f0a82ebc50729850b0398bd4dab7e91db9bf20e2ec06350d551b0f04d336b56c0d37e6fed90af998750a2f6a9a7d8fcc06a7923fee993d407996d4a010966

Download Submit
memory/716-6-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/716-9-0x0000000000400000-0x00000000006F3000-memory.dmp

Filesize
2.9MB

Download
memory/4784-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/4784-1-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/4784-8-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download