Analysis
- user interaction
yes - max time kernel
150s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 15:55
General
- Target Install_New_theme.bat
- Size 609B
- Sample260705-tc1d2adv7w
- SHA256 7f60a4179212c4b85d3af563987f047c7d416621803e5d2187cbcdfe8bca34b1
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme -no_pause'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/SpotX/refs/heads/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/SpotX/run.ps1' })} $p """" | iex2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -V3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" --help all3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-05_16-55-45\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.93-x64.exe3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4972-0-0x00007FFAB7D4F000-0x00007FFAB7D50000-memory.dmp
memory/4972-3-0x00000179564D0000-0x00000179564F2000-memory.dmp
memory/4972-4-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-5-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-7-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-6-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-8-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-9-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-10-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-11-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-12-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-13-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-14-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-17-0x0000017956A00000-0x0000017956A1E000-memory.dmp
memory/4972-18-0x0000017956A20000-0x0000017956AD2000-memory.dmp
memory/4972-19-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-21-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-20-0x0000017956AE0000-0x0000017956AEA000-memory.dmp
memory/4972-23-0x0000017956B20000-0x0000017956B44000-memory.dmp
memory/4972-22-0x0000017956B20000-0x0000017956B4A000-memory.dmp
memory/4972-24-0x0000017956CB0000-0x0000017956E72000-memory.dmp
memory/4972-25-0x00000179573B0000-0x00000179578D8000-memory.dmp
memory/4972-26-0x0000017957090000-0x0000017957294000-memory.dmp
memory/4972-27-0x0000017956B20000-0x0000017956B3A000-memory.dmp
memory/4972-28-0x0000017956BE0000-0x0000017956C0A000-memory.dmp
memory/4972-29-0x0000017956B00000-0x0000017956B08000-memory.dmp
memory/4972-30-0x0000017956B10000-0x0000017956B16000-memory.dmp
memory/4972-31-0x0000017956B40000-0x0000017956B4A000-memory.dmp
memory/4972-32-0x0000017956B50000-0x0000017956B58000-memory.dmp
memory/4972-33-0x0000017956B90000-0x0000017956BB6000-memory.dmp
memory/4972-34-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-36-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-37-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-38-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp
memory/4972-40-0x00007FFAB7BC0000-0x00007FFAB8564000-memory.dmp