bbe80b41484f53964fa5ffe3465d23228fddb4138364e291ed142642f1ef266d

Analysis

max time kernel
149s
max time network
114s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spotify/Skibidi.ini
Size 59B
Sample260502-tmp12sbz9v
SHA256 bbe80b41484f53964fa5ffe3465d23228fddb4138364e291ed142642f1ef266d
MD5 f9e40091643753fc101c0c36a1cb5ceb
SHA1 9064f19c2648a546c23949b6740f9ac2b0bb8950
SHA512 cd8ed5f8a2415e66ba892045bb416f7ea2229142c95ae23ce558f4ed511c05e5db2f5aa185113b03454ec84d1de3f53667b43892fcf8113a7576a69b2b9c9817
TLSH
T179A002CB4558418403D4420A4634699111C0790902643038406B52921BE49D1147B357
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2544	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Spotify\Skibidi.ini
1⤵
- Modifies registry class
PID:3000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-1-0x000002C195BC0000-0x000002C195C5E000-memory.dmp

Download

memory/3000-0-0x0000020CE3F50000-0x0000020CE403A000-memory.dmp