File name:

SPOTIFY ACCOUNT CHECKER 2023.rar

Full analysis: https://app.any.run/tasks/9e72269e-23bf-4583-b5de-fe2a3ed83633
Verdict: Malicious activity
Analysis date: February 19, 2024, 15:31:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9E48BBE73A3DA22A0F926272979B58F1

SHA1:

69E4035A42232BF9B96CB4A8937EEC2C3446934C

SHA256:

145C73FAD3D59491FE8F39975703C56280A4FBD24F514615AFFEE362B3118DE6

SSDEEP:

98304:zILpOj4NnwJxbkELEOpCeZVfK+TBfSMiZJHolx/INSuTu/uKBfMVQCLcjKD8SUHO:kTOupvI1KvrJ34iv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4052)

    • Reads the BIOS version

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Reads the Internet Settings

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • powershell.exe (PID: 3488)
      • powershell.exe (PID: 2896)
      • LZMYBCTLTD.exe (PID: 1368)
      • powershell.exe (PID: 2592)
      • LZMYBCTLTD.exe (PID: 1608)
      • powershell.exe (PID: 764)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3564)
      • LZMYBCTLTD.exe (PID: 1264)
      • powershell.exe (PID: 2736)
      • LZMYBCTLTD.exe (PID: 2536)
      • powershell.exe (PID: 3840)
      • powershell.exe (PID: 3748)

    • Reads security settings of Internet Explorer

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Application launched itself

      • Spotify Checker.exe (PID: 2444)

    • Starts POWERSHELL.EXE for commands execution

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Script adds exclusion path to Windows Defender

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3488)
      • powershell.exe (PID: 2896)
      • powershell.exe (PID: 2592)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 764)
      • powershell.exe (PID: 2736)
      • powershell.exe (PID: 3564)
      • powershell.exe (PID: 3748)
      • powershell.exe (PID: 3840)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1236)

    • Executing commands from a ".bat" file

      • Spotify Checker.exe (PID: 116)

    • Starts CMD.EXE for commands execution

      • Spotify Checker.exe (PID: 116)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4052)

    • Reads the computer name

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • wmpnscfg.exe (PID: 3132)
      • LZMYBCTLTD.exe (PID: 2536)

    • Checks supported languages

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • wmpnscfg.exe (PID: 3132)
      • LZMYBCTLTD.exe (PID: 2536)

    • Manual execution by a user

      • Spotify Checker.exe (PID: 2444)
      • wmpnscfg.exe (PID: 3132)

    • Process checks whether UAC notifications are on

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Creates files in the program directory

      • Spotify Checker.exe (PID: 116)

    • Create files in a temporary directory

      • Spotify Checker.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
21
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe spotify checker.exe no specs spotify checker.exe powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs wmpnscfg.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe
Spotify Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\spotify checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
764"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1236C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\s38.0.bat" "C:\Windows\System32\cmd.exe—Spotify Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1264C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1368"C:\ProgramData\active\LZMYBCTLTD.exe" C:\ProgramData\active\LZMYBCTLTD.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1608C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1900timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2020"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2444"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Logon Application
Exit code:
1
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\spotify checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2536C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
25 580
Read events
25 381
Write events
199
Delete events
0

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SPOTIFY ACCOUNT CHECKER 2023.rar
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
3
Suspicious files
19
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\Spotify Checker.exe —
MD5:—
SHA256:—
116Spotify Checker.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\SMDiagnostics.dllexecutable
MD5:F1D92AC71001BCC24B99044EE675619F
SHA256:5DF3A2E0329D7668AD0F6C426F6E4C6D1ECD45225B2C39D96B15CD7B6A1BBE53
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\updater.inibinary
MD5:BDB71E725923415AD118571A96A58F9C
SHA256:CDFD1E0DB31EF98BE246AC26C14CBD47B24A11F85DD255FE55F93F8FB9FCAB11
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\x64\SQLite.Interop.dllexecutable
MD5:56A504A34D2CFBFC7EAA2B68E34AF8AD
SHA256:9309FB2A3F326D0F2CC3F2AB837CFD02E4F8CB6B923B3B2BE265591FD38F4961
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\x86\SQLite.Interop.dllexecutable
MD5:8BE215ABF1F36AA3D23555A671E7E3BE
SHA256:83F332EA9535814F18BE4EE768682ECC7720794AEDC30659EB165E46257A7CAE
2896powershell.exeC:\Users\admin\AppData\Local\Temp\kozyaqrd.thr.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3488powershell.exeC:\Users\admin\AppData\Local\Temp\fgodbbcp.dvo.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3488powershell.exeC:\Users\admin\AppData\Local\Temp\xlwnzpwe.ngo.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2592powershell.exeC:\Users\admin\AppData\Local\Temp\gqlm4ogx.4os.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SPOTIFY ACCOUNT CHECKER 2023.rar