File name:

SPOTIFY ACCOUNT CHECKER 2023.rar

Full analysis: https://app.any.run/tasks/9e72269e-23bf-4583-b5de-fe2a3ed83633
Verdict: Malicious activity
Analysis date: February 19, 2024, 15:31:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9E48BBE73A3DA22A0F926272979B58F1

SHA1:

69E4035A42232BF9B96CB4A8937EEC2C3446934C

SHA256:

145C73FAD3D59491FE8F39975703C56280A4FBD24F514615AFFEE362B3118DE6

SSDEEP:

98304:zILpOj4NnwJxbkELEOpCeZVfK+TBfSMiZJHolx/INSuTu/uKBfMVQCLcjKD8SUHO:kTOupvI1KvrJ34iv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 4052)

    • Reads the BIOS version

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Starts a Microsoft application from unusual location

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)

    • Reads the Internet Settings

      • Spotify Checker.exe (PID: 2444)
      • powershell.exe (PID: 3488)
      • powershell.exe (PID: 2896)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • powershell.exe (PID: 2592)
      • LZMYBCTLTD.exe (PID: 1608)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 764)
      • powershell.exe (PID: 2020)
      • LZMYBCTLTD.exe (PID: 1264)
      • powershell.exe (PID: 2736)
      • powershell.exe (PID: 3564)
      • LZMYBCTLTD.exe (PID: 2536)
      • powershell.exe (PID: 3840)
      • powershell.exe (PID: 3748)

    • Script adds exclusion path to Windows Defender

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Starts POWERSHELL.EXE for commands execution

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Reads security settings of Internet Explorer

      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)
      • Spotify Checker.exe (PID: 2444)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3488)
      • powershell.exe (PID: 2896)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 2592)
      • powershell.exe (PID: 764)
      • powershell.exe (PID: 2020)
      • powershell.exe (PID: 3564)
      • powershell.exe (PID: 2736)
      • powershell.exe (PID: 3840)
      • powershell.exe (PID: 3748)

    • Executing commands from a ".bat" file

      • Spotify Checker.exe (PID: 116)

    • Starts CMD.EXE for commands execution

      • Spotify Checker.exe (PID: 116)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1236)

    • The process executes via Task Scheduler

      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)

    • Application launched itself

      • Spotify Checker.exe (PID: 2444)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)

    • Checks supported languages

      • Spotify Checker.exe (PID: 2444)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3132)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)
      • Spotify Checker.exe (PID: 116)

    • Manual execution by a user

      • Spotify Checker.exe (PID: 2444)
      • wmpnscfg.exe (PID: 3132)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4052)

    • Reads the computer name

      • Spotify Checker.exe (PID: 2444)
      • Spotify Checker.exe (PID: 116)
      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • wmpnscfg.exe (PID: 3132)
      • LZMYBCTLTD.exe (PID: 2536)
      • LZMYBCTLTD.exe (PID: 1264)

    • Creates files in the program directory

      • Spotify Checker.exe (PID: 116)

    • Process checks whether UAC notifications are on

      • LZMYBCTLTD.exe (PID: 1368)
      • LZMYBCTLTD.exe (PID: 1608)
      • LZMYBCTLTD.exe (PID: 1264)
      • LZMYBCTLTD.exe (PID: 2536)
      • Spotify Checker.exe (PID: 116)

    • Create files in a temporary directory

      • Spotify Checker.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
21
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe spotify checker.exe no specs spotify checker.exe powershell.exe no specs powershell.exe no specs cmd.exe no specs timeout.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs wmpnscfg.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs lzmybctltd.exe no specs powershell.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe
Spotify Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\spotify checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
764"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Roaming'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1236C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\s38.0.bat" "C:\Windows\System32\cmd.exe—Spotify Checker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1264C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1368"C:\ProgramData\active\LZMYBCTLTD.exe" C:\ProgramData\active\LZMYBCTLTD.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1608C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1900timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
2020"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—LZMYBCTLTD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2444"C:\Users\admin\Desktop\Spotify Checker.exe" C:\Users\admin\Desktop\Spotify Checker.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Logon Application
Exit code:
1
Version:
10.0.17134.1
Modules
Images
c:\users\admin\desktop\spotify checker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2536C:\ProgramData\active\LZMYBCTLTD.exe C:\ProgramData\active\LZMYBCTLTD.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Logon Application
Exit code:
0
Version:
10.0.17134.1
Modules
Images
c:\programdata\active\lzmybctltd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
25 580
Read events
25 381
Write events
199
Delete events
0

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SPOTIFY ACCOUNT CHECKER 2023.rar
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
3
Suspicious files
19
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\Spotify Checker.exe —
MD5:—
SHA256:—
116Spotify Checker.exeC:\ProgramData\active\LZMYBCTLTD.exe —
MD5:—
SHA256:—
3488powershell.exeC:\Users\admin\AppData\Local\Temp\fgodbbcp.dvo.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
116Spotify Checker.exeC:\Users\admin\AppData\Local\Temp\s38.0.battext
MD5:0769F729730FD8B70E28DC3B63ADDF84
SHA256:5FABDE7F96EF6235BF739D41027176112F4953E53D0FBA8DF57E2610AA9076C7
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\x86\SQLite.Interop.dllexecutable
MD5:8BE215ABF1F36AA3D23555A671E7E3BE
SHA256:83F332EA9535814F18BE4EE768682ECC7720794AEDC30659EB165E46257A7CAE
2896powershell.exeC:\Users\admin\AppData\Local\Temp\kozyaqrd.thr.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2592powershell.exeC:\Users\admin\AppData\Local\Temp\gqlm4ogx.4os.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2896powershell.exeC:\Users\admin\AppData\Local\Temp\ed4pv45w.ybq.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb4052.21304\SPOTIFY ACCOUNT CHECKER 2023\License.dlltext
MD5:B08A5C34CF0A06615DA2CA89010D8B4F
SHA256:04CC5B3B49A7E9E9B6C66C7BE59A20992BF2653746B5D43829C383FB233F88FA
3488powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SPOTIFY ACCOUNT CHECKER 2023.rar