File name:

SPOTIFY ACCOUNT CHECKER 2023.rar

Full analysis: https://app.any.run/tasks/9e72269e-23bf-4583-b5de-fe2a3ed83633
Verdict: Malicious activity
Analysis date: February 19, 2024, 15:31:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9E48BBE73A3DA22A0F926272979B58F1

SHA1:

69E4035A42232BF9B96CB4A8937EEC2C3446934C

SHA256:

145C73FAD3D59491FE8F39975703C56280A4FBD24F514615AFFEE362B3118DE6

SSDEEP:

98304:zILpOj4NnwJxbkELEOpCeZVfK+TBfSMiZJHolx/INSuTu/uKBfMVQCLcjKD8SUHO:kTOupvI1KvrJ34iv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4052)

    • Reads the BIOS version

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 2536)
      • LZMYBCTLTD.exe (PID: 1264)

    • Reads the Internet Settings

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • powershell.exe (PID: 2896)
      • powershell.exe (PID: 3488)
      • LZMYBCTLTD.exe (PID: 1368)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 2592)
      • LZMYBCTLTD.exe (PID: 1608)
      • powershell.exe (PID: 764)
      • powershell.exe (PID: 2020)
      • LZMYBCTLTD.exe (PID: 1264)
      • powershell.exe (PID: 3564)
      • powershell.exe (PID: 2736)
      • LZMYBCTLTD.exe (PID: 2536)
      • powershell.exe (PID: 3840)
      • powershell.exe (PID: 3748)

    • Reads security settings of Internet Explorer

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Starts a Microsoft application from unusual location

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)

    • Application launched itself

      • Spotify Checker.exe (PID: 2444)

    • Script adds exclusion path to Windows Defender

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Starts POWERSHELL.EXE for commands execution

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3488)
      • powershell.exe (PID: 2896)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 2592)
      • powershell.exe (PID: 764)
      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3564)
      • powershell.exe (PID: 2736)
      • powershell.exe (PID: 3840)
      • powershell.exe (PID: 3748)

    • Executing commands from a ".bat" file

      • Spotify Checker.exe (PID: 116)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1236)

    • Starts CMD.EXE for commands execution

      • Spotify Checker.exe (PID: 116)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4052)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)

    • Checks supported languages

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3132)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Reads the computer name

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3132)
      • LZMYBCTLTD.exe (PID: 2536)
      • LZMYBCTLTD.exe (PID: 1264)

    • Process checks whether UAC notifications are on

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Manual execution by a user

      • Spotify Checker.exe (PID: 2444)
      • wmpnscfg.exe (PID: 3132)

    • Creates files in the program directory

      • Spotify Checker.exe (PID: 116)

    • Create files in a temporary directory

      • Spotify Checker.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
21
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe spotify checker.exe no specs spotify checker.exe powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs wmpnscfg.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe
Spotify Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\spotify checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
764"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1236C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\s38.0.bat" "C:\Windows\System32\cmd.exe—Spotify Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1264C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1368"C:\ProgramData\active\LZMYBCTLTD.exe" C:\ProgramData\active\LZMYBCTLTD.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1608C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1900timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2020"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2444"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Logon Application
Exit code:
1
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\spotify checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2536C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
25 580
Read events
25 381
Write events
199
Delete events
0

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SPOTIFY ACCOUNT CHECKER 2023.rar
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
3
Suspicious files
19
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\Spotify Checker.exe —
MD5:—
SHA256:—
116Spotify Checker.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\License.dlltext
MD5:B08A5C34CF0A06615DA2CA89010D8B4F
SHA256:04CC5B3B49A7E9E9B6C66C7BE59A20992BF2653746B5D43829C383FB233F88FA
2896powershell.exeC:\Users\admin\AppData\Local\Temp\kozyaqrd.thr.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2896powershell.exeC:\Users\admin\AppData\Local\Temp\ed4pv45w.ybq.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\updater.inibinary
MD5:BDB71E725923415AD118571A96A58F9C
SHA256:CDFD1E0DB31EF98BE246AC26C14CBD47B24A11F85DD255FE55F93F8FB9FCAB11
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\SMDiagnostics.dllexecutable
MD5:F1D92AC71001BCC24B99044EE675619F
SHA256:5DF3A2E0329D7668AD0F6C426F6E4C6D1ECD45225B2C39D96B15CD7B6A1BBE53
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\x64\SQLite.Interop.dllexecutable
MD5:56A504A34D2CFBFC7EAA2B68E34AF8AD
SHA256:9309FB2A3F326D0F2CC3F2AB837CFD02E4F8CB6B923B3B2BE265591FD38F4961
3488powershell.exeC:\Users\admin\AppData\Local\Temp\fgodbbcp.dvo.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
116Spotify Checker.exeC:\Users\admin\AppData\Local\Temp\s38.0.battext
MD5:0769F729730FD8B70E28DC3B63ADDF84
SHA256:5FABDE7F96EF6235BF739D41027176112F4953E53D0FBA8DF57E2610AA9076C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SPOTIFY ACCOUNT CHECKER 2023.rar