01b4f5e2634a6454723810bfe8e62daa028bf2927151dc02ebd0d9b2ed78d180

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SpotifySetup.exe
Size

996KB
MD5

035cf561f36e43c88b0703662af55a77
SHA1

8edc027e81a6d60b2f03ce8d9920cb2d0d842a37
SHA256

01b4f5e2634a6454723810bfe8e62daa028bf2927151dc02ebd0d9b2ed78d180
SHA512

40cace2c48d3a569de4db6207dd42f54be9a096d6ddc224ea665c5caea4a9ce4a7fedfcc485986f0418ec09f3d70e8f8583a40a5f4ac7152e58b33a76115f1ae
SSDEEP

12288:WBpldB2dDvonzcsVNK4VWkCpMtf0vG3VKhI3sO3agFlpIDO+Ek+:42dLycs/KyHCpMtf0kKh83hMq+Ek+

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe --autostart --minimized"	Spotify.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	Spotify.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	Spotify.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\manifest.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\_metadata\verified_contents.json	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\manifest.fingerprint	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\_platform_specific\win_x64\widevinecdm.dll.sig	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\_platform_specific\win_x64\widevinecdm.dll	Spotify.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\LICENSE	Spotify.exe

Executes dropped EXE 8 IoCs

pid	Process
4432	SpWebInst0.exe
2336	Spotify.exe
5036	Spotify.exe
4264	Spotify.exe
4452	Spotify.exe
980	Spotify.exe
4752	Spotify.exe
4304	Spotify.exe

Loads dropped DLL 18 IoCs

pid	Process
2336	Spotify.exe
2336	Spotify.exe
5036	Spotify.exe
5036	Spotify.exe
4264	Spotify.exe
4264	Spotify.exe
4264	Spotify.exe
4264	Spotify.exe
4264	Spotify.exe
4452	Spotify.exe
4452	Spotify.exe
980	Spotify.exe
980	Spotify.exe
4752	Spotify.exe
4752	Spotify.exe
4264	Spotify.exe
4304	Spotify.exe
4304	Spotify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpotifySetup.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppName = "Spotify.exe"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\AppPath = "C:\\Users\\Admin\\AppData\\Roaming\\Spotify"	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}	Spotify.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{5C0D11B8-C5F6-4be3-AD2C-2B1A3EB94AB6}\Policy = "3"	Spotify.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\spotify	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open	Spotify.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\",0"	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command	Spotify.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\ddeexec	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\spotify	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\spotify\shell	Spotify.exe
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\spotify\shell\open	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\URL Protocol	Spotify.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\spotify\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Spotify\\Spotify.exe\" --protocol-uri=\"%1\""	Spotify.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe
Token: SeShutdownPrivilege	2336	Spotify.exe
Token: SeCreatePagefilePrivilege	2336	Spotify.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2336	Spotify.exe
2336	Spotify.exe
2336	Spotify.exe
2336	Spotify.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2336	Spotify.exe
2336	Spotify.exe
2336	Spotify.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4432	3140	SpotifySetup.exe	96
PID 3140 wrote to memory of 4432	3140	SpotifySetup.exe	96
PID 4432 wrote to memory of 2336	4432	SpWebInst0.exe	97
PID 4432 wrote to memory of 2336	4432	SpWebInst0.exe	97
PID 2336 wrote to memory of 5036	2336	Spotify.exe	99
PID 2336 wrote to memory of 5036	2336	Spotify.exe	99
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4264	2336	Spotify.exe	100
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101
PID 2336 wrote to memory of 4452	2336	Spotify.exe	101

C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exe
  SpWebInst0.exe /webinstall
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
    Spotify.exe
    3⤵
    - Adds Run key to start application
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.45.454 --initial-client-data=0x3c8,0x3cc,0x3d0,0x3c4,0x3d4,0x7ffacc07aa60,0x7ffacc07aa6c,0x7ffacc07aa78
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5036
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=gpu-process --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1712,i,757060488914902816,12617115969167694526,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4264
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3240,i,757060488914902816,12617115969167694526,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4452
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=3508,i,757060488914902816,12617115969167694526,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:980
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=renderer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --disable-spell-checking --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3588,i,757060488914902816,12617115969167694526,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4752
  - - C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
      "C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --log-severity=disable --user-agent-product="Chrome/127.0.6533.100 Spotify/1.2.45.454" --lang=en --user-data-dir="C:\Users\Admin\AppData\Local\Spotify" --field-trial-handle=4576,i,757060488914902816,12617115969167694526,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping2336_1483057692\manifest.json

Filesize
1001B

MD5
2ff237adbc218a4934a8b361bcd3428e

SHA1
efad279269d9372dcf9c65b8527792e2e9e6ca7d

SHA256
25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827

SHA512
bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
baa1d5babc6ca1222119eb2442d81dbd

SHA1
36ac06b306a772046783c41ea2f20daf7f87072c

SHA256
4592fe416d3deefb6d3cf47f74ebd8dad5edc0150e93462d62559888d340e2e9

SHA512
3a72b312ef3f88e8f548efd7d4232f361ae8293627845791ce14ac278e6d38dc2b26ead0dd9bb06c76cccd349c5a26c7d9f8904b803302ed21bb389fd2b622e1

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
312ac200f546a29f8666897a0ad8ed26

SHA1
82d5cb8e25770edc280e131cd926cc45a303171c

SHA256
194c8bb4e250316b468d5d9bf49c2b9a13f4b0e541356a5d2e8bad085669e6da

SHA512
7dd3d81a1853d4ae0c7922b1b943da3911fcc4a88d841f59df1cebefbeea068b46df7bf2089caa85275175508201966860b3567149f3c57d80f84200ad2045ef

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
904B

MD5
725e9dfbd1feb705baf0e4cf4ca155e1

SHA1
b936aa8300b6400c20ec424c66e785ae95188fbb

SHA256
371d12499f37590caf8ed7092536d97b530ededae3b6f4ced8dcba9a2df9c43a

SHA512
d0bb556e5da179192a0f7873ab33465c53a1fb18fc4d3d04620b640f2c0a95ccb35ce013a158093d35dc5facd2d458d7e7eaa2ff6b4d5b39e4e5b85eef286304

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Spotify\Browser\Network\Network Persistent State~RFe595ac8.TMP

Filesize
59B

MD5
78bfcecb05ed1904edce3b60cb5c7e62

SHA1
bf77a7461de9d41d12aa88fba056ba758793d9ce

SHA256
c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572

SHA512
2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GrShaderCache\data_0

Filesize
44KB

MD5
03ffd7cc760a5e92ad8878bf7f8a1a7b

SHA1
8076e5443d537d130b9a9d23306697f8b3298712

SHA256
71330d5541164aaaf7dbbbd6c64678884f4758a329ee18989a6c95dbb87cba94

SHA512
e56dd525d619dbefbd0f2bfbd0ecee52b8a75c8a900f429368200d35d73117f9c7e0260e410cd38621e2648189326734f3cbdbe86ff652ebb1c34b57a2e1fec7

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GrShaderCache\data_1

Filesize
264KB

MD5
ca0efd11282a2f451aa91e4007ed9272

SHA1
e939aff1892e9b6a8ea157c5e9bd834cf7051aff

SHA256
b078eab4dbf0f8654537e0c00617098f3bbdfdea5b1548d1522a355d816fa072

SHA512
1c90c06ee9274cc61bd79d564f0fc65731f4f12d235286f313aea514b6b8f4a546cf8d6ae2c66a7139911b76847ad10664c29b72824e8e23aa76bbe757a3d100

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GrShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Spotify\GrShaderCache\data_3

Filesize
4.0MB

MD5
aba225eba8bc91a647d185ee1baff86a

SHA1
403f0ddd5f8d90028e663a605590f723a8416754

SHA256
342b138587df0a37827eec5cef160274bd2b825639695835d9a4caf5cffdbb47

SHA512
61dddc95697863144b35e636af8c82ee07a14a0c2a50bf57b0177af0a955c311e3c9b963e01ea32070d2467af23680e90d1f5b8b28ac738da25ee03f179e1ce7

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
744B

MD5
ae03262ecefa3f762f966566660a0d56

SHA1
3043fc4f30ccbd2ec8d4ff964e9e428ab952fef0

SHA256
abff87aaf6aa1295c94c614ce63193bab061ce7f5f675ee964e2b647aa09be57

SHA512
6e15999a503b84a93c4af10b5750e0a1f0c44472a0eb7cfe4fa550a351850b6e7b1d3b2f4b485395ebe58e2a3b8ebfc765166ef117b1f8c1706af737ab3e557f

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json

Filesize
856B

MD5
24933530d5f967e2564cd5aa7ab488c5

SHA1
b4fda6080abc1eba938648f35ebc09564d929407

SHA256
2e0d959b589050474bc2b4793f16502ed3536ff9bb0a3e8f780e966dd15cd580

SHA512
f17a31dc2d3088fac1b25e0d2689aa3f962dde00cb70e4304e6605167c92c749a285997bb9f6f3fc1fb483495bd956d7de92952b1fd7ac3eb82a17dd97a38be8

Download Submit
C:\Users\Admin\AppData\Local\Spotify\LocalPrefs.json~RFe590db2.TMP

Filesize
529B

MD5
19546b0cb824875a0806817ba4c8bd27

SHA1
78c10b0a5099015cd8043f47a423dd97577d5998

SHA256
317f243d8361ac28bb472ee78302f24b0e3e0c4e802e099642b7be26cdfc9696

SHA512
13357d7896ee3171a00e55dc89e3dc192ca0d3f85e5f399e394239bd44739cc6eafaeaf026308215d0cceeb925051167f71770c1f3f830e320c8dcdfeaf427ec

Download Submit
C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat

Filesize
56B

MD5
cb6b428aa072c88fecbe3e3bc5907756

SHA1
6519c0f2e1c056d895e7fc3161050c5a4f9b8374

SHA256
c435ecdd55b6c1b56fbf07a3d7a329bea479e8c36f7ac88cef6c3a7a9dffbeb1

SHA512
4560601e6c0905e25171dea5415b27fae111212ff70b3957773c139b0d2a8f437b7901a1ea35c26e27ed83a852f9ad2c2a9c999fd6818cad5cd53016f267570d

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Spotify\public.ldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Apps\login.spa

Filesize
3.5MB

MD5
e9846e050aaeef7832434bd4f3cf74ad

SHA1
6d5f53821a06b34c5a3f3affc09762025b5f0db8

SHA256
5846ec7b50c9e1fef4916347e93f5b33899d06d816d7e7a6a107b161400cdfcd

SHA512
df212a5a0404af9d414ef5f7e797281c776f9ab8002c2f7c67df7fa568ce7fcee933c7f85aacf66f9edf4768bf5f08db12a15eac4528618e1bf3a0e3c8784544

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe

Filesize
33.8MB

MD5
a8b0089fc441a9654d781823b31fc85a

SHA1
bc3317bade99fbebb94318b93cdc8f384c948b82

SHA256
b23746f04a8c00dfa531183d4abfdfdcdf4079330c3ebae8e670fb0989d68485

SHA512
8e95c601ea0726a985a46f4fceb1a37cd371d197ac23433784779de32d6e0ff300a14ff8a6c38fe8db97089cb2be7849c73f5e11d25c701d147cf57418948401

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_100_percent.pak

Filesize
665KB

MD5
08d5b9ba6de2fdfeba949a500788d3db

SHA1
a501a28ab57cbceec7096fceea8f59adf1c49d56

SHA256
617368e617aa56193eec7b21a05edc3116314434cf490cba13109084468fab2d

SHA512
acd5305032fb6c4da5f594804e0c7253d8370c8dda9f709a2385daaa193261b0d0885394fbc888438b326d363992466e67c7ab1e620d89490ef2ad7942bcf11e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_200_percent.pak

Filesize
1.0MB

MD5
593d0c686b7e657fe8fecb6f87793bfa

SHA1
c9364f2efd003e69e9e13a47c30ce41e0ae45c64

SHA256
65ea636b01f8deb739d65d0a2244f1e476efa9df06ea2bfe06cb3107dad465a8

SHA512
69cfc43e5038a9c52e78a443e8745c343844d5041c4780e1792f0ac9d5fedacd0d82e4805276f01ca0c9692f786ea8c1164c5bc36aafe94233b8883886478c73

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll

Filesize
1.3MB

MD5
067fd9866c7ebbcb0228161627061fbc

SHA1
28b229da92b05477815b0ec0bcf45d88bface843

SHA256
becf2b4384496e44b0b600a226170bbc9724645bdd0ad39bb561904d6f9b1df9

SHA512
5597d1af5ab799aaa7c1f0f8b6466dc73c0ec6980bcd6b85780c12ce57c3432b0e9163732bcba1cf1e86490409be2661f4d0395c40eff403c0a1b4cb533da00e

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg

Filesize
603B

MD5
38e00009737071c00590b944da6b4c25

SHA1
c1614ef3706538e5df7c411741ae5e18339d716a

SHA256
312aee1310a36d2ffd6306b3ee9452fa37cf25b808dfceb853afd060c58aaa6c

SHA512
5232512898e7f3755d37181c990bb6286563057c1aa3dfc1f56a6452fc12b00698dc4dd9801659f6ff9017e9f00f7bd8d313be0fa751d5e83d2f36b69e4ba15a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\d3dcompiler_47.dll

Filesize
4.7MB

MD5
fda904e5a347d8ac3471a7938746e126

SHA1
b37f28eda1fb8540ae86be295cd49a26724d9b43

SHA256
9f182852b4a28edf08d9f95fcd1a2278bdcda01a07541bf8096e1066ae750742

SHA512
a2dfaa98bcbdfee0c9c35200dd0a9c2caa0b58f9d45b59314e43e076ce19b1689f5497da09393f089ba057090b788244885dc13cd2c6ee2ef91bb73472f5838b

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\icudtl.dat

Filesize
10.0MB

MD5
ffd67c1e24cb35dc109a24024b1ba7ec

SHA1
99f545bc396878c7a53e98a79017d9531af7c1f5

SHA256
9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

SHA512
e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libEGL.dll

Filesize
463KB

MD5
65a29ef08ee521b053d80779d1b828b9

SHA1
1732065416873ee9a526ac6a7a689a0aad09d3ba

SHA256
b924ad51be3074f6f7e6a613ff5292f8993136f3fee7071efd8174c742f10f61

SHA512
619f7dd86414576def29956011b767de37533219c311c402e26727971a3124314f6136d4c6bd043762ef049bfa0457cb897bc19b45e7942b864f03521122c8e2

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\libGLESv2.dll

Filesize
7.6MB

MD5
53f6fb4f6588ad32e6c6d893810ab370

SHA1
8d5da2851f1bfc5a812f32ad208597107d320731

SHA256
7780b75943c196de42aa900e965754bb994f6fd414df94953e5699525334bc1b

SHA512
0915d605ef4cbc4051bde6686d8740c0a24cc87ca7174392c371778f5525d125e16df2952e18d9a82c886bc9245dcb7d5d62fdaedf5d4e211aad9386bc5e5962

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en-US.pak

Filesize
473KB

MD5
47ef63cd09a805111daffbaefea61ae2

SHA1
fc16c4a01f07a84983eedf1b775a7e90a7462740

SHA256
486569377bc470c932424935e6d18f9cb752cae1d5d21d9aaedc5d0ee3ebee90

SHA512
86a99afce4a38ae65641a9f120fe90aedbe96fc389ec6c41b61442ccfee466d668e46c9bb7bb588d77ff1803f33ddfd18c3d80aa2be52412064b079913e0018a

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\locales\en.mo

Filesize
16KB

MD5
e67df29f9aef1fcacd64aa11e6bf1579

SHA1
928f4dfea93433dbf772c3158522a1b2bfbc0169

SHA256
e269c4cb638b7fdb42462596157b5e6e77843bd60f36b58ba35ee40483fac094

SHA512
7a23994b2d1a33590e08b992c81ebf39551d4f3f278b9a4de9cbb09c7b87e0b578e5cda287d83ee89ac5af3f9e8db90c46d9faeaa0140cccf1ba0a33f9a83346

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\resources.pak

Filesize
8.3MB

MD5
5272bdb104b38c8481e8946433aac159

SHA1
933997cc65745e7b90b2b711f9427a20fdb3207f

SHA256
5204d2ed8b2f2fd566955484696a40f25e3c400774073ae697f0472211fa2d7a

SHA512
fd1f0623f9c453538c3d792bba614075186b22f0c4f0851992d37846583a9b104bcdff2324afc3666f4a090fb7304f87753647066b394f80665ba7fe4b82a583

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\v8_context_snapshot.bin

Filesize
656KB

MD5
11e43c7e737f2d2857c665360364a74f

SHA1
0fb05690956f772a40536bd6e0c485ac6dcc89a7

SHA256
27513ca3fb00b59445b1098b3af8ee44761206045c070754160b81c959758564

SHA512
d9391a98be45b83d37997b123396793777a603aad48b66c673fdced5c85ca7246aa23e78adbd62d04b1f7bb0c8981b0a272cdcf33a4353db2a642167b4230952

Download Submit
C:\Users\Admin\AppData\Roaming\Spotify\vk_swiftshader.dll

Filesize
5.0MB

MD5
474a717e1b666878f89b9baaec5a1784

SHA1
eb57ae184ac94c0423171a8dfda718b2bdf41a91

SHA256
67787fbc92a35efd5bbc0bb81de42d5486f8fed2d58a640feee7974d17ce6fe7

SHA512
7d7bd09376cc4438f95a9c927c89864f57b666c8eee4e72a7ca72f76fe8114c9c8b1feb6dd428088af6d987825bcca8dc09c4cf2664f40432454bf6938091bd6

Download Submit
memory/2336-359-0x00007FF681420000-0x00007FF683633000-memory.dmp

Filesize
34.1MB

Download
memory/2336-208-0x00007FF681420000-0x00007FF683633000-memory.dmp

Filesize
34.1MB

Download
memory/4452-284-0x00007FFAEA0B0000-0x00007FFAEA0B1000-memory.dmp

Filesize
4KB

Download
memory/4452-285-0x00007FFAE9E00000-0x00007FFAE9E01000-memory.dmp

Filesize
4KB

Download
memory/5036-226-0x00007FF681420000-0x00007FF683633000-memory.dmp

Filesize
34.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads