9f08f3c12d5d71272692d99e4b0e6918274653b4b13bf1c8fc9bbfd23967d3d1

Analysis

max time kernel
899s
max time network
543s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpotX-main/scripts/installer-lang/lv.ps1
Size 3KB
Sample260715-chjvsshv9p
SHA256 9f08f3c12d5d71272692d99e4b0e6918274653b4b13bf1c8fc9bbfd23967d3d1
MD5 281723c401d3963d7b743f967724661e
SHA1 d022b4b9592a85b2c0f6985ec5a37c14298a6eb7
SHA512 8ca1f882dac1dcfbbb96352835adfb7dab4c5cd859207e643bab42a2a00d85f438a5a702ed87ac2657fda4bc4300f9617fea10d415f904e063631fea575d7b8d
TLSH
T1C8812121C501CEF65A3E8E445D766C2563CDAA4BFE000A00B24F83DD5FFA248D9F6A96
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2416	PowerShell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	PowerShell.exe
2416	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	PowerShell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SpotX-main\scripts\installer-lang\lv.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6980

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x00007FFC6282F000-0x00007FFC62830000-memory.dmp

Download

memory/2416-3-0x0000020DE4630000-0x0000020DE4652000-memory.dmp

Download

memory/2416-4-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2416-5-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2416-6-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2416-8-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2416-9-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download