875a892309034bae5d61ca84b5f82d6de3f8f7502276330735a1eef2afbe8547

Analysis

max time kernel
10s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 17:27

Target

SpotifyPremium-main/PatchSpotify.bat
Size

555B
MD5

4ca101b1fe032e90dc8949e39bcdcf62
SHA1

928a6086baa6fa7004291d89ea552f8f69f8ff91
SHA256

67ca76e9f25b686b6931dbd2ea342eab2024476523dd2efa499898645fff3fcd
SHA512

302421d094bfa04a2c520f501d6bc82d5e3d56eed3d8240451ef34ce76d5b8b7f200fca73720e0b0b81863bd3e14b859e33fa7eca1ad064e83eedd85ac517cdd

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
2984	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	taskkill.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2980	1900	cmd.exe	31
PID 1900 wrote to memory of 2980	1900	cmd.exe	31
PID 1900 wrote to memory of 2980	1900	cmd.exe	31
PID 1900 wrote to memory of 2984	1900	cmd.exe	32
PID 1900 wrote to memory of 2984	1900	cmd.exe	32
PID 1900 wrote to memory of 2984	1900	cmd.exe	32
PID 1900 wrote to memory of 2944	1900	cmd.exe	34
PID 1900 wrote to memory of 2944	1900	cmd.exe	34
PID 1900 wrote to memory of 2944	1900	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SpotifyPremium-main\PatchSpotify.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\mode.com
  MODE con:cols=100 lines=20
  2⤵
  PID:2980
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Spotify.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\xcopy.exe
  xcopy /s "C:\Users\Admin\AppData\Local\Temp\SpotifyPremium-main\chrome_elf.dll" "C:\Users\Admin\AppData\Roaming\Spotify" /y
  2⤵
  PID:2944