File name: | Spotify 1.1.4.zip |
Full analysis: | https://app.any.run/tasks/807be729-f101-4f70-9ff1-374df50b8da7 |
Verdict: | Malicious activity |
Analysis date: | September 30, 2020, 13:56:54 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | C9BEBE0EDAD47DD2902C2049FD818013 |
SHA1: | 49C9B4799265AA8113AC818291573426FBFFB6FC |
SHA256: | 016E6A77D49F9520690EFC0A24CCD6BC489DD8C36B9C5A9861092D0D48EBA6BF |
SSDEEP: | 12288:1vXdhlthsiiG1yvXdhlthsiiG1AvXdhlthsiiG1D:1tsiioytsiioAtsiioD |
.xpi | | | Mozilla Firefox browser extension (66.6) |
---|---|---|
.zip | | | ZIP compressed archive (33.3) |
ZipFileName: | Spotify 1.1.4/downgrade.bat |
---|---|
ZipUncompressedSize: | 367801 |
ZipCompressedSize: | 367801 |
ZipCRC: | 0xc87cf666 |
ZipModifyDate: | 2020:06:06 10:33:05 |
ZipCompression: | None |
ZipBitFlag: | 0x0808 |
ZipRequiredVersion: | 20 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2452 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\Spotify 1.1.4.zip.xpi | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2764 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Spotify 1.1.4.zip.xpi" | C:\Program Files\WinRAR\WinRAR.exe | — | rundll32.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
272 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Spotify 1.1.4.zip.xpi" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
4092 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Spotify 1.1.4.zip.xpi" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
2948 | C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503} | C:\Windows\system32\DllHost.exe | — | svchost.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3312 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Spotify 1.1.4.zip.xpi" | C:\Program Files\WinRAR\WinRAR.exe | — | WinRAR.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3764 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Spotify 1.1.4\README.txt | C:\Windows\system32\NOTEPAD.EXE | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2104 | cmd /c ""C:\Users\admin\Desktop\Spotify 1.1.4\install.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3628 | taskkill /f /im Spotify.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2260 | taskkill /f /im spotifywebhelper.exe | C:\Windows\system32\taskkill.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
3312 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3312.12830\Spotify 1.1.4\downgrade.bat | — | |
MD5:— | SHA256:— | |||
3312 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3312.12830\Spotify 1.1.4\netutils.dll | — | |
MD5:— | SHA256:— | |||
3312 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3312.12830\Spotify 1.1.4\install.bat | — | |
MD5:— | SHA256:— | |||
3312 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3312.12830\Spotify 1.1.4\README.txt | — | |
MD5:— | SHA256:— | |||
752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BFJVM89BRZEO6S1UHQ3U.temp | — | |
MD5:— | SHA256:— | |||
3512 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\H9APFJQNC7SB8QATVY7H.temp | — | |
MD5:— | SHA256:— | |||
3084 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1G326NOJ8S23YOZK70DB.temp | — | |
MD5:— | SHA256:— | |||
3084 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1c88cf.TMP | binary | |
MD5:36FE326E12493E805B62142553A1E43C | SHA256:3DD6ACC81930940EC26CE9794D473AC8869FCDB0D48BC71A20C27D80FF693B9F | |||
752 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1c16eb.TMP | binary | |
MD5:36FE326E12493E805B62142553A1E43C | SHA256:3DD6ACC81930940EC26CE9794D473AC8869FCDB0D48BC71A20C27D80FF693B9F | |||
3512 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1c8506.TMP | binary | |
MD5:36FE326E12493E805B62142553A1E43C | SHA256:3DD6ACC81930940EC26CE9794D473AC8869FCDB0D48BC71A20C27D80FF693B9F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3084 | powershell.exe | GET | — | 151.101.2.133:80 | http://upgrade.spotify.com/upgrade/client/win32-x86/spotify_installer-1.1.4.197.g92d52c4f-13.exe | US | — | — | malicious |
— | — | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
— | — | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAUvBuID4ULSHj7RL9jO6Z8%3D | US | der | 471 b | whitelisted |
— | — | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
— | — | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAUvBuID4ULSHj7RL9jO6Z8%3D | US | der | 471 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3084 | powershell.exe | 151.101.2.133:80 | upgrade.spotify.com | Fastly | US | malicious |
2108 | iexplore.exe | 35.186.224.25:443 | www.spotify.com | Google Inc. | US | suspicious |
Domain | IP | Reputation |
---|---|---|
upgrade.spotify.com |
| malicious |
www.spotify.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3084 | powershell.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
3084 | powershell.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |