File name:

SpotifyChecker.zip

Full analysis: https://app.any.run/tasks/6285c3dd-71af-4151-b54c-9f898489c8cc
Verdict: Malicious activity
Analysis date: July 12, 2020, 15:00:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BFF0DCCA1CDC5533D2E4F9AA7ED737C2

SHA1:

7D61A73B4C5E105E5EC4770DD6CACF26E8C5ABB1

SHA256:

045DCF9BA8E3B4265F72D4F76E9114F4794530FD9DC9B996AA259917506C58D6

SSDEEP:

12288:5XSh7HgfqfjLPdDl3Eh7A0lDcab4TkNInlONc0fRpHs4swD/ZGmk/:ZSlHgeFDl07A0lDcOwOBfRK8ZGmG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • spotify checker.exe (PID: 3236)
      • spotify checker.exe (PID: 3504)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1852)

  • INFO

    • Manual execution by user

      • spotify checker.exe (PID: 3504)
      • spotify checker.exe (PID: 3236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:07:08 16:58:13
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Spotify Checker/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe spotify checker.exe no specs spotify checker.exe

Process information

PID
CMD
Path
Indicators
Parent process
1852"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SpotifyChecker.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3236"C:\Users\admin\Desktop\Spotify Checker\spotify checker.exe" C:\Users\admin\Desktop\Spotify Checker\spotify checker.exe
explorer.exe
User:
admin
Company:
SPARKASSE GÖTTINGEN
Integrity Level:
HIGH
Description:
LETUSWORK
Exit code:
0
Version:
11.5.1.0
Modules
Images
c:\users\admin\desktop\spotify checker\spotify checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3504"C:\Users\admin\Desktop\Spotify Checker\spotify checker.exe" C:\Users\admin\Desktop\Spotify Checker\spotify checker.exe—explorer.exe
User:
admin
Company:
SPARKASSE GÖTTINGEN
Integrity Level:
MEDIUM
Description:
LETUSWORK
Exit code:
0
Version:
11.5.1.0
Modules
Images
c:\users\admin\desktop\spotify checker\spotify checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
452
Read events
430
Write events
22
Delete events
0

Modification events

(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1852) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12F\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SpotifyChecker.zip
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1852) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
1
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1852WinRAR.exeC:\Users\admin\Desktop\Spotify Checker\README.mdtext
MD5:—
SHA256:—
1852WinRAR.exeC:\Users\admin\Desktop\Spotify Checker\spotify checker.exeexecutable
MD5:—
SHA256:—
1852WinRAR.exeC:\Users\admin\Desktop\Spotify Checker\VersionNumbertext
MD5:EE7AB3E7E15D1E00EC001CA33B4571F1
SHA256:44E161E4495CAC2CF7858043E9E6418E9579F0DDCFAE826F9A372622968CE066
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpotifyChecker.zip