File name:

Spotify 1.1.4.zip

Full analysis: https://app.any.run/tasks/9727dd30-1f28-408e-aaef-dbe3015211e9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 14:03:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C9BEBE0EDAD47DD2902C2049FD818013

SHA1:

49C9B4799265AA8113AC818291573426FBFFB6FC

SHA256:

016E6A77D49F9520690EFC0A24CCD6BC489DD8C36B9C5A9861092D0D48EBA6BF

SSDEEP:

12288:1vXdhlthsiiG1yvXdhlthsiiG1AvXdhlthsiiG1D:1tsiioytsiioAtsiioD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3012)
      • cmd.exe (PID: 608)

    • Runs injected code in another process

      • cmd.exe (PID: 3012)

    • Application was injected by another process

      • dllhost.exe (PID: 3960)

    • Loads dropped or rewritten executable

      • Spotify.exe (PID: 3388)
      • Spotify.exe (PID: 1872)
      • Spotify.exe (PID: 3980)
      • Spotify.exe (PID: 2376)

    • Changes the autorun value in the registry

      • Spotify.exe (PID: 3388)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 1236)

    • Application was dropped or rewritten from another process

      • Spotify.exe (PID: 3388)
      • Spotify.exe (PID: 1872)
      • Spotify.exe (PID: 3980)
      • Spotify.exe (PID: 2376)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3012)
      • cmd.exe (PID: 608)

    • Creates files in the user directory

      • powershell.exe (PID: 1480)
      • powershell.exe (PID: 1236)
      • powershell.exe (PID: 3556)
      • cmd.exe (PID: 3012)
      • powershell.exe (PID: 3008)
      • Spotify.exe (PID: 3388)
      • powershell.exe (PID: 2248)
      • spotify_installer-1.1.4.197.g92d52c4f-13.exe (PID: 3960)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1332)
      • powershell.exe (PID: 3556)
      • cmd.exe (PID: 608)

    • Uses ICACLS.EXE to modify access control list

      • cmd.exe (PID: 2604)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 3012)
      • spotify_installer-1.1.4.197.g92d52c4f-13.exe (PID: 3960)
      • cmd.exe (PID: 608)

    • Application launched itself

      • Spotify.exe (PID: 3388)
      • cmd.exe (PID: 608)

    • Modifies the open verb of a shell class

      • Spotify.exe (PID: 3388)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 1496)

  • INFO

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 2548)

    • Dropped object may contain Bitcoin addresses

      • spotify_installer-1.1.4.197.g92d52c4f-13.exe (PID: 3960)

    • Reads the hosts file

      • Spotify.exe (PID: 3388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: None
ZipModifyDate: 2020:06:06 10:33:05
ZipCRC: 0xc87cf666
ZipCompressedSize: 367801
ZipUncompressedSize: 367801
ZipFileName: Spotify 1.1.4/downgrade.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
27
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject rundll32.exe no specs winrar.exe no specs cmd.exe taskkill.exe no specs powershell.exe no specs findstr.exe no specs powershell.exe powershell.exe no specs cmd.exe icacls.exe no specs findstr.exe no specs icacls.exe no specs dllhost.exe spotify_installer-1.1.4.197.g92d52c4f-13.exe powershell.exe no specs spotify.exe spotify.exe no specs spotify.exe no specs spotify.exe no specs cmd.exe taskkill.exe no specs taskkill.exe no specs findstr.exe no specs powershell.exe no specs cmd.exe no specs reg.exe no specs findstr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608cmd /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa1332.4536\install.bat" "C:\Windows\system32\cmd.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
660taskkill /f /im Spotify.exe C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
852icacls "C:\Users\admin\AppData\Local\Spotify\Update" /deny "admin":W C:\Windows\system32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
948findstr "PackageFullName" C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
1236powershell.exe -ExecutionPolicy Bypass -Command (new-object System.Net.WebClient).DownloadFile('http://upgrade.spotify.com/upgrade/client/win32-x86/spotify_installer-1.1.4.197.g92d52c4f-13.exe','spotify_installer-1.1.4.197.g92d52c4f-13.exe')C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1332"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Spotify 1.1.4.zip.xpi"C:\Program Files\WinRAR\WinRAR.exe—rundll32.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1480powershell Get-AppxPackage -Name "SpotifyAB.SpotifyMusic" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1496taskkill /f /im Spotify.exe C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1496C:\Windows\system32\cmd.exe /c reg query HKCR\spotify\shell\open\commandC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
1872C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Spotify\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x304,0x298,0x29c,0x308,0x2a0,0x6eb4bf60,0x6eb4bf70,0x6eb4bf7cC:\Users\admin\AppData\Roaming\Spotify\Spotify.exe—Spotify.exe
User:
admin
Company:
Spotify Ltd
Integrity Level:
MEDIUM
Description:
Spotify
Exit code:
1
Version:
1.1.4.197
Modules
Images
c:\users\admin\appdata\roaming\spotify\spotify.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
3 150
Read events
2 679
Write events
469
Delete events
2

Modification events

(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Value:
Adobe Acrobat Reader DC
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\VideoLAN\VLC\vlc.exe
Value:
VLC media player
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Value:
Microsoft Word
(PID) Process:(2548) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
12
Suspicious files
65
Text files
6
Unknown types
87

Dropped files

PID
Process
Filename
Type
1480powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\05C9815HNSW2R0W8DYGR.temp —
MD5:—
SHA256:—
1236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OBLA2D6QTDTM307CPDLD.temp —
MD5:—
SHA256:—
1236powershell.exeC:\Users\admin\Desktop\spotify_installer-1.1.4.197.g92d52c4f-13.exe —
MD5:—
SHA256:—
3556powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C36KDBI1EYNHV26ZE95W.temp —
MD5:—
SHA256:—
1480powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
1480powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1b6156.TMPbinary
MD5:—
SHA256:—
1236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1b6425.TMPbinary
MD5:—
SHA256:—
1236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3556powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
3556powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1bfe61.TMPbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
1
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1236
powershell.exe
GET
200
151.101.2.133:80
http://upgrade.spotify.com/upgrade/client/win32-x86/spotify_installer-1.1.4.197.g92d52c4f-13.exe
US
executable
66.2 Mb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1236
powershell.exe
151.101.2.133:80
upgrade.spotify.com
Fastly
US
malicious

DNS requests

Domain
IP
Reputation
upgrade.spotify.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
malicious

Threats

PID
Process
Class
Message
1236
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1236
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Process
Message
Spotify.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Spotify directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Spotify 1.1.4.zip