Analysis
- user interaction
yes - max time kernel
82s - max time network
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
SpotifySetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
SpotifySetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target SpotifySetup.exe
- Size 1.2MB
- Sample260816-e5e68szzfy
- SHA256 718ba1cb98b42de2c4609953531e6b255e31ca31fd3645cb98b2ca040763fea3
- MD5 884e2b49b20437f0f543b5ba79a61752
- SHA1 c1e5089dc7fb85485f821fe6ce5b0a3a5fb97bc5
- SHA512 3bf199b6907d1dd54d67b34bfaa633b59d6ead249aec16918bae36c8e2eefc61607aa8f41bebb5ab406d96ff6e01f2a84bacb92bca617e23c5d18d76cbd43747
- SSDEEP 12288:S1hE8IcIrFEP48eZx5PpQsM4F5nLYU8ygnAgoF540B7DTSFi14ju:S128nIr2P48i5PpQJ4FNLYc76u
- TLSH T1D9555C895B28D6AEE363D17D4021D139E6717C220FD1924A42F9A2FC1E7B334796BF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 10 6504 SpotifySetup.exe - Executes dropped EXE 1 IoCs
pid Process 2684 SpWebInst0.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3600 taskmgr.exe Token: SeSystemProfilePrivilege 3600 taskmgr.exe Token: SeCreateGlobalPrivilege 3600 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe 3600 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3600 taskmgr.exe 3600 taskmgr.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6504 wrote to memory of 2684 6504 SpotifySetup.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"C:\Users\Admin\AppData\Local\Temp\SpotifySetup.exe"1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:6504 -
C:\Users\Admin\AppData\Roaming\Spotify\SpWebInst0.exeSpWebInst0.exe /webinstall2⤵
- Executes dropped EXE
PID:2684
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:2616
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:6596