Overview

overview

8

Static

static

1

SpotX-main...el.svg

windows11-ltsc_2024-x64

3

SpotX-main...ty.svg

windows11-ltsc_2024-x64

8

SpotX-main...ux.svg

windows11-ltsc_2024-x64

3

SpotX-main...aq.svg

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...ll.bat

windows11-ltsc_2024-x64

1

SpotX-main...ock.js

windows11-ltsc_2024-x64

3

SpotX-main/run.ps1

windows11-ltsc_2024-x64

8

SpotX-main...to.bat

windows11-ltsc_2024-x64

8

SpotX-main...em.bat

windows11-ltsc_2024-x64

8

SpotX-main...bn.ps1

windows11-ltsc_2024-x64

3

SpotX-main...cs.ps1

windows11-ltsc_2024-x64

8

SpotX-main...de.ps1

windows11-ltsc_2024-x64

8

SpotX-main...el.ps1

windows11-ltsc_2024-x64

3

SpotX-main...en.ps1

windows11-ltsc_2024-x64

3

SpotX-main...es.ps1

windows11-ltsc_2024-x64

8

SpotX-main...fa.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...il.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fr.ps1

windows11-ltsc_2024-x64

8

SpotX-main...hi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...hu.ps1

windows11-ltsc_2024-x64

3

SpotX-main...id.ps1

windows11-ltsc_2024-x64

3

SpotX-main...it.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ja.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ka.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ko.ps1

windows11-ltsc_2024-x64

8

SpotX-main...lv.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pl.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pt.ps1

windows11-ltsc_2024-x64

8

SpotX-main...ro.ps1

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    899s
  • max time network
    554s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SpotX-main/Install_New_theme.bat
  • Size 600B
  • Sample260715-chjvsshv9p
  • SHA256 a461119f4dcaca45b8438792b6daba9a83d520f47127ebb7a7ed6d68c0ac1008
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-main\Install_New_theme.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -V
        3⤵
          PID:5568
        • C:\Windows\system32\curl.exe
          "C:\Windows\system32\curl.exe" --help all
          3⤵
            PID:5800
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.94-x64.exe
            3⤵
              PID:5500
            • C:\Windows\system32\curl.exe
              "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.94-x64.exe
              3⤵
                PID:1968
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe
                3⤵
                  PID:252
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4896
              • C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe
                "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe"
                2⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:3980
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  Spotify.exe /INSTALLCOMPLETE
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:2004
                  • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                    C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.94.582 --initial-client-data=0x22c,0x254,0x258,0x238,0x25c,0x7ffbc5045448,0x7ffbc5045454,0x7ffbc5045460
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4232
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:1712
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:6008
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:3248
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:3952
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5616
              • C:\Windows\System32\SecurityHealthHost.exe
                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                1⤵
                  PID:2360

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 595B
                      • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      settings.dat
                      • Path C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad\settings.dat
                      • Size 56B
                      • SHA256 272b98e8d921c636d4473a66a7feb712252b3c75af05aa67a311395f7af283a8
                      • MD5 SHA1 SHA512
                      Submit Download

                      Spotify.exe
                      • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      • Size 2.8MB
                      • SHA256 aace19a4f713561183a37db6ca01f1343e431acaba36816003a8f0bcbdb3c875
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      chrome_elf.dll
                      • Path C:\Users\Admin\AppData\Roaming\Spotify\chrome_elf.dll
                      • Size 2.4MB
                      • SHA256 1c82eefb8145e92f8d267f7fea87b475ad084f7611c71c8df38ca2b8c31c96e7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      crash_reporter.cfg
                      • Path C:\Users\Admin\AppData\Roaming\Spotify\crash_reporter.cfg
                      • Size 632B
                      • SHA256 7b1be81fe871975a15d22d0bc0b0d5bf31909eeda5d91a5a86b846239991ddd1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      zh-Hant.mo
                      • Path C:\Users\Admin\AppData\Roaming\Spotify\locales\zh-Hant.mo
                      • Size 16KB
                      • SHA256 75cdeb4157d44565f56e900476bf34b7760a148a3bfdb826045adff24e96615a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Spotify.lnk
                      • Path C:\Users\Admin\Desktop\Spotify.lnk
                      • Size 1KB
                      • SHA256 cb9556fe507c4d5ba8630500d6aef8bb27b599ef72dee36725d50185d17beba7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/2952-26-0x000001AF62520000-0x000001AF62544000-memory.dmp
                      Download

                      memory/2952-22-0x000001AF62460000-0x000001AF62512000-memory.dmp
                      Download

                      memory/2952-6-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-7-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-8-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-9-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-10-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-11-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-12-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-13-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-14-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-15-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-16-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-17-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-18-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-21-0x000001AF61D50000-0x000001AF61D6E000-memory.dmp
                      Download

                      memory/2952-24-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-4-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-27-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-25-0x000001AF62520000-0x000001AF6254A000-memory.dmp
                      Download

                      memory/2952-23-0x000001AF61D70000-0x000001AF61D7A000-memory.dmp
                      Download

                      memory/2952-5-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-28-0x000001AF626F0000-0x000001AF628B2000-memory.dmp
                      Download

                      memory/2952-29-0x000001AF62DF0000-0x000001AF63318000-memory.dmp
                      Download

                      memory/2952-30-0x000001AF63530000-0x000001AF63734000-memory.dmp
                      Download

                      memory/2952-31-0x000001AF62540000-0x000001AF6255A000-memory.dmp
                      Download

                      memory/2952-35-0x000001AF62570000-0x000001AF6257A000-memory.dmp
                      Download

                      memory/2952-36-0x000001AF62580000-0x000001AF62588000-memory.dmp
                      Download

                      memory/2952-37-0x000001AF625C0000-0x000001AF625E6000-memory.dmp
                      Download

                      memory/2952-34-0x000001AF62560000-0x000001AF62566000-memory.dmp
                      Download

                      memory/2952-33-0x000001AF62530000-0x000001AF62538000-memory.dmp
                      Download

                      memory/2952-32-0x000001AF62610000-0x000001AF6263A000-memory.dmp
                      Download

                      memory/2952-3-0x000001AF61CF0000-0x000001AF61D12000-memory.dmp
                      Download

                      memory/2952-0-0x00007FFBCFDBF000-0x00007FFBCFDC0000-memory.dmp
                      Download

                      memory/2952-38-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-39-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-40-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-42-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/2952-43-0x00007FFBCFC30000-0x00007FFBD05D4000-memory.dmp
                      Download

                      memory/5616-394-0x00000275001E0000-0x00000275002E0000-memory.dmp
                      Download

                      memory/5616-409-0x0000027504200000-0x0000027504220000-memory.dmp
                      Download

                      memory/5616-399-0x0000027501FA0000-0x0000027501FC0000-memory.dmp
                      Download

                      memory/5616-400-0x00000275143E0000-0x00000275144E0000-memory.dmp
                      Download

                      memory/5616-438-0x0000027514740000-0x0000027514760000-memory.dmp
                      Download