Overview

overview

8

Static

static

1

SpotX-main...el.svg

windows11-ltsc_2024-x64

3

SpotX-main...ty.svg

windows11-ltsc_2024-x64

8

SpotX-main...ux.svg

windows11-ltsc_2024-x64

3

SpotX-main...aq.svg

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...me.bat

windows11-ltsc_2024-x64

8

SpotX-main...ll.bat

windows11-ltsc_2024-x64

1

SpotX-main...ock.js

windows11-ltsc_2024-x64

3

SpotX-main/run.ps1

windows11-ltsc_2024-x64

8

SpotX-main...to.bat

windows11-ltsc_2024-x64

8

SpotX-main...em.bat

windows11-ltsc_2024-x64

8

SpotX-main...bn.ps1

windows11-ltsc_2024-x64

3

SpotX-main...cs.ps1

windows11-ltsc_2024-x64

8

SpotX-main...de.ps1

windows11-ltsc_2024-x64

8

SpotX-main...el.ps1

windows11-ltsc_2024-x64

3

SpotX-main...en.ps1

windows11-ltsc_2024-x64

3

SpotX-main...es.ps1

windows11-ltsc_2024-x64

8

SpotX-main...fa.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...il.ps1

windows11-ltsc_2024-x64

3

SpotX-main...fr.ps1

windows11-ltsc_2024-x64

8

SpotX-main...hi.ps1

windows11-ltsc_2024-x64

3

SpotX-main...hu.ps1

windows11-ltsc_2024-x64

3

SpotX-main...id.ps1

windows11-ltsc_2024-x64

3

SpotX-main...it.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ja.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ka.ps1

windows11-ltsc_2024-x64

3

SpotX-main...ko.ps1

windows11-ltsc_2024-x64

8

SpotX-main...lv.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pl.ps1

windows11-ltsc_2024-x64

3

SpotX-main...pt.ps1

windows11-ltsc_2024-x64

8

SpotX-main...ro.ps1

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    898s
  • max time network
    569s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 02:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SpotX-main/run.ps1
  • Size 60KB
  • Sample260715-chjvsshv9p
  • SHA256 56a6bedc5ddb79aa308798b242a626f44238a87314de232b559f37bf17831bf9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\SpotX-main\run.ps1
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im Spotify.exe /t
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:6064
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mybpic0n\mybpic0n.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B6E.tmp" "c:\Users\Admin\AppData\Local\Temp\mybpic0n\CSC5CAD17EDC53E44D99135DDE10535666.TMP"
        3⤵
          PID:776
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" -V
        2⤵
          PID:4304
        • C:\Windows\system32\curl.exe
          "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.34.783.g923721d9-5822.exe --retry 2 --ssl-no-revoke
          2⤵
            PID:4640
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" -Is -w "%{http_code} \n" -o /dev/null https://download.scdn.co/upgrade/client/win32-x86/spotify_installer-1.2.34.783.g923721d9-5822.exe --retry 2 --ssl-no-revoke
            2⤵
              PID:5048
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:1432
            • C:\Windows\system32\sihost.exe
              sihost.exe
              1⤵
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2420
              • C:\Windows\explorer.exe
                explorer.exe /LOADSAVEDWINDOWS
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:1216
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2368
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3496
            • C:\Windows\System32\SecurityHealthHost.exe
              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
              1⤵
                PID:5060

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    prep_Activatable Class_Hermes_perf.cache
                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                    • Size 599B
                    • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    RES1B6E.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RES1B6E.tmp
                    • Size 1KB
                    • SHA256 e654292b5e7de999a6c62868b49a6bb225d9ea9aa6d43bd54fcef0cc4e31bb17
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    mybpic0n.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\mybpic0n\mybpic0n.dll
                    • Size 4KB
                    • SHA256 15c8ab01ea351c671ef412465264ca3e3c54657e458807546e41ef3f85dce8b4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CSC5CAD17EDC53E44D99135DDE10535666.TMP
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\mybpic0n\CSC5CAD17EDC53E44D99135DDE10535666.TMP
                    • Size 652B
                    • SHA256 82bf91605b6b5c4ce5601d5a1598e3b6cc58f9b377e528f6cd035c61fffa908a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    mybpic0n.0.cs
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\mybpic0n\mybpic0n.0.cs
                    • Size 1KB
                    • SHA256 04d45e3134df0b6a8d1affb893c9e0d0240db163bf45baaca1c58f7acd2e56c5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    mybpic0n.cmdline
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\mybpic0n\mybpic0n.cmdline
                    • Size 369B
                    • SHA256 0fc1475f42515ff5e17ba7fcc2639816561e5e404717e3dc2136443b4cff103b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/1216-244-0x000000000E8D0000-0x000000000EA3C000-memory.dmp
                    Download

                    memory/2368-89-0x00000122039B0000-0x00000122039D0000-memory.dmp
                    Download

                    memory/2368-77-0x00000122001E0000-0x00000122002E0000-memory.dmp
                    Download

                    memory/2368-109-0x0000012203C10000-0x0000012203C30000-memory.dmp
                    Download

                    memory/2368-123-0x00000122141B0000-0x00000122141D0000-memory.dmp
                    Download

                    memory/2368-90-0x0000012213E30000-0x0000012213F30000-memory.dmp
                    Download

                    memory/2368-79-0x00000122001E0000-0x00000122002E0000-memory.dmp
                    Download

                    memory/3428-29-0x0000018754D90000-0x0000018754DAA000-memory.dmp
                    Download

                    memory/3428-36-0x0000018754E30000-0x0000018754E44000-memory.dmp
                    Download

                    memory/3428-17-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-18-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-21-0x0000018754C70000-0x0000018754C8E000-memory.dmp
                    Download

                    memory/3428-22-0x0000018754C90000-0x0000018754D42000-memory.dmp
                    Download

                    memory/3428-23-0x0000018754D50000-0x0000018754D5A000-memory.dmp
                    Download

                    memory/3428-25-0x0000018754D90000-0x0000018754DBA000-memory.dmp
                    Download

                    memory/3428-26-0x0000018754D90000-0x0000018754DB4000-memory.dmp
                    Download

                    memory/3428-24-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-27-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-0-0x00007FFD1A67F000-0x00007FFD1A680000-memory.dmp
                    Download

                    memory/3428-28-0x0000018754F80000-0x0000018755184000-memory.dmp
                    Download

                    memory/3428-31-0x0000018754D70000-0x0000018754D78000-memory.dmp
                    Download

                    memory/3428-30-0x0000018754E50000-0x0000018754E7A000-memory.dmp
                    Download

                    memory/3428-33-0x0000018754DB0000-0x0000018754DBA000-memory.dmp
                    Download

                    memory/3428-32-0x0000018754D80000-0x0000018754D86000-memory.dmp
                    Download

                    memory/3428-34-0x0000018754DC0000-0x0000018754DC8000-memory.dmp
                    Download

                    memory/3428-35-0x0000018754E00000-0x0000018754E26000-memory.dmp
                    Download

                    memory/3428-16-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-15-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-14-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-50-0x0000018754E80000-0x0000018754EA7000-memory.dmp
                    Download

                    memory/3428-49-0x0000018754C80000-0x0000018754C88000-memory.dmp
                    Download

                    memory/3428-13-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-12-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-11-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-51-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-52-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-53-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-10-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-9-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-8-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-7-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-6-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-4-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download

                    memory/3428-5-0x0000018754730000-0x0000018754752000-memory.dmp
                    Download

                    memory/3428-1-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp
                    Download