Overview

overview

8

Static

static

1

SpotX-main...el.svg

windows11-ltsc_2024-x64

3

SpotX-main...ty.svg

windows11-ltsc_2024-x64

8

SpotX-main...ux.svg

windows11-ltsc_2024-x64

3

SpotX-main...aq.svg

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...ll.bat

windows11-ltsc_2024-x64

1

SpotX-main...ock.js

windows11-ltsc_2024-x64

3

SpotX-main/run.ps1

windows11-ltsc_2024-x64

8

SpotX-main...to.bat

windows11-ltsc_2024-x64

8

SpotX-main...em.bat

windows11-ltsc_2024-x64

8

SpotX-main...bn.ps1

windows11-ltsc_2024-x64

3

SpotX-main...cs.ps1

windows11-ltsc_2024-x64

8

SpotX-main...de.ps1

windows11-ltsc_2024-x64

8

SpotX-main...el.ps1

windows11-ltsc_2024-x64

3

SpotX-main...en.ps1

windows11-ltsc_2024-x64

3

SpotX-main...es.ps1

windows11-ltsc_2024-x64

8

SpotX-main...fa.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...il.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fr.ps1

windows11-ltsc_2024-x64

8

SpotX-main...hi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...hu.ps1

windows11-ltsc_2024-x64

3

SpotX-main...id.ps1

windows11-ltsc_2024-x64

3

SpotX-main...it.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ja.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ka.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ko.ps1

windows11-ltsc_2024-x64

8

SpotX-main...lv.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pl.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pt.ps1

windows11-ltsc_2024-x64

8

SpotX-main...ro.ps1

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    899s
  • max time network
    552s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SpotX-main/Install_Old_theme.bat
  • Size 666B
  • Sample260715-chjvsshv9p
  • SHA256 f645c0e9c9dd665bca8b85a1ab509ae436e539bbb0904246f25e8cb672bf2194
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwarediscoveryexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\SpotX-main\Install_Old_theme.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-v 1.2.13.661.ga588f749-4064 -confirm_spoti_recomended_over -block_update_on'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/spotx-official.github.io/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/run.ps1' })} $p """" | iex
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:476
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -V
        3⤵
          PID:1768
        • C:\Windows\system32\curl.exe
          "C:\Windows\system32\curl.exe" --help all
          3⤵
            PID:4980
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.13.661.ga588f749-x86.exe
            3⤵
              PID:2672
            • C:\Windows\system32\curl.exe
              "C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.13.661.ga588f749-x86.exe
              3⤵
                PID:5768
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe
                3⤵
                  PID:1348
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2180
              • C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe
                "C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-07-15_03-05-43\SpotifySetup.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1580
                • C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                  Spotify.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4836
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:5020
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:5524
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:5052
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:5796
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:1496
              • C:\Windows\System32\SecurityHealthHost.exe
                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                1⤵
                  PID:3240

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Spotify.exe
                      • Path C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe
                      • Size 20.0MB
                      • SHA256 ebaa795a21604bd623b10248419fb9216107bab804ff568a562ee6e5cb5cd404
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Spotify.lnk
                      • Path C:\Users\Admin\Desktop\Spotify.lnk
                      • Size 1KB
                      • SHA256 2f6bb19ce0fb876960ad447e33ea156b48ca202cd0c3e5378f8ae3fa98c4c89c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/476-28-0x00000218CE3A0000-0x00000218CE3BA000-memory.dmp
                      Download

                      memory/476-23-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-6-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-8-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-9-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-10-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-11-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-12-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-13-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-14-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-15-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-16-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-17-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-20-0x00000218CDE50000-0x00000218CDE6E000-memory.dmp
                      Download

                      memory/476-21-0x00000218CDE70000-0x00000218CDF22000-memory.dmp
                      Download

                      memory/476-31-0x00000218CE390000-0x00000218CE396000-memory.dmp
                      Download

                      memory/476-22-0x00000218CDF30000-0x00000218CDF3A000-memory.dmp
                      Download

                      memory/476-25-0x00000218CDF70000-0x00000218CDF94000-memory.dmp
                      Download

                      memory/476-24-0x00000218CDF70000-0x00000218CDF9A000-memory.dmp
                      Download

                      memory/476-26-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-27-0x00000218CE590000-0x00000218CE794000-memory.dmp
                      Download

                      memory/476-0-0x00007FF83E9BF000-0x00007FF83E9C0000-memory.dmp
                      Download

                      memory/476-7-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-32-0x00000218CE3C0000-0x00000218CE3CA000-memory.dmp
                      Download

                      memory/476-1-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-33-0x00000218CE3D0000-0x00000218CE3D8000-memory.dmp
                      Download

                      memory/476-34-0x00000218CE410000-0x00000218CE436000-memory.dmp
                      Download

                      memory/476-29-0x00000218CE460000-0x00000218CE48A000-memory.dmp
                      Download

                      memory/476-36-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-35-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-37-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-38-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-39-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-41-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-5-0x00007FF83E830000-0x00007FF83F1D4000-memory.dmp
                      Download

                      memory/476-30-0x00000218CE380000-0x00000218CE388000-memory.dmp
                      Download

                      memory/476-4-0x00000218CD910000-0x00000218CD932000-memory.dmp
                      Download

                      memory/4836-223-0x0000000000400000-0x000000000182E000-memory.dmp
                      Download

                      memory/4836-221-0x0000000000400000-0x000000000182E000-memory.dmp
                      Download

                      memory/5052-416-0x000000000DC00000-0x000000000E47B000-memory.dmp
                      Download

                      memory/5052-446-0x000000000DC00000-0x000000000E47B000-memory.dmp
                      Download

                      memory/5796-293-0x0000026214790000-0x00000262147B0000-memory.dmp
                      Download

                      memory/5796-266-0x00000262041F0000-0x0000026204210000-memory.dmp
                      Download

                      memory/5796-253-0x00000262043D0000-0x00000262044D0000-memory.dmp
                      Download

                      memory/5796-252-0x0000026202FB0000-0x0000026202FD0000-memory.dmp
                      Download

                      memory/5796-247-0x00000262001E0000-0x00000262002E0000-memory.dmp
                      Download