875a892309034bae5d61ca84b5f82d6de3f8f7502276330735a1eef2afbe8547

Analysis

max time kernel
123s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 17:27

Target

SpotifyPremium-main/PatchSpotify.bat
Size

555B
MD5

4ca101b1fe032e90dc8949e39bcdcf62
SHA1

928a6086baa6fa7004291d89ea552f8f69f8ff91
SHA256

67ca76e9f25b686b6931dbd2ea342eab2024476523dd2efa499898645fff3fcd
SHA512

302421d094bfa04a2c520f501d6bc82d5e3d56eed3d8240451ef34ce76d5b8b7f200fca73720e0b0b81863bd3e14b859e33fa7eca1ad064e83eedd85ac517cdd

Score

1^/10

Kills process with taskkill 1 IoCs

evasion

pid	Process
1520	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 4996	2240	cmd.exe	93
PID 2240 wrote to memory of 4996	2240	cmd.exe	93
PID 2240 wrote to memory of 1520	2240	cmd.exe	94
PID 2240 wrote to memory of 1520	2240	cmd.exe	94
PID 2240 wrote to memory of 4832	2240	cmd.exe	96
PID 2240 wrote to memory of 4832	2240	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotifyPremium-main\PatchSpotify.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\mode.com
  MODE con:cols=100 lines=20
  2⤵
  PID:4996
- C:\Windows\system32\taskkill.exe
  taskkill /f /im Spotify.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1520
- C:\Windows\system32\xcopy.exe
  xcopy /s "C:\Users\Admin\AppData\Local\Temp\SpotifyPremium-main\chrome_elf.dll" "C:\Users\Admin\AppData\Roaming\Spotify" /y
  2⤵
  PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,1602949858158667699,12464335823361976127,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
1⤵
PID:3352