Analysis
- user interaction
yes - max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 17:43
General
- Target Install_New_theme.bat
- Size 615B
- Sample260801-wam22aej21
- SHA256 37c2b1036b0e85d3654e657b57f581bf960b35597ce33a4a587cb727c630e5d2
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Install_New_theme.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12; $p='-new_theme -block_update_on'; """ & { $(try { iwr -useb 'https://raw.githubusercontent.com/SpotX-Official/SpotX/refs/heads/main/run.ps1' } catch { $p+= ' -m'; iwr -useb 'https://spotx-official.github.io/SpotX/run.ps1' })} $p """" | iex2⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -V3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" --help all3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-34\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.95-x64.exe3⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -q -L -k --fail-with-body --connect-timeout 15 --ssl-no-revoke --progress-bar -o C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-34\SpotifySetup.exe -w " HTTP_STATUS:%{http_code} " https://loadspot.amd64fox1.workers.dev/download/spotify_installer-1.2.95-x64.exe3⤵
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-34\SpotifySetup.exe3⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-34\SpotifySetup.exe"C:\Users\Admin\AppData\Local\Temp\SpotX_Temp-2026-08-01_18-43-34\SpotifySetup.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeSpotify.exe /INSTALLCOMPLETE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exeC:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Spotify\User Data\Crashpad" --url=https://crashdump.spotify.com:443/ --annotation=platform=win64 --annotation=product=spotify --annotation=version=1.2.95.452 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ffc1df75448,0x7ffc1df75454,0x7ffc1df754604⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Spotify.exe
chrome_elf.dll
crash_reporter.cfg
zh-Hant.mo
memory/3032-19-0x000001E536440000-0x000001E53646A000-memory.dmp
memory/3032-31-0x000001E5364B0000-0x000001E5364B8000-memory.dmp
memory/3032-8-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-10-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-9-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-32-0x000001E5364F0000-0x000001E536516000-memory.dmp
memory/3032-12-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-13-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-16-0x000001E535600000-0x000001E53561E000-memory.dmp
memory/3032-17-0x000001E535620000-0x000001E5356D2000-memory.dmp
memory/3032-18-0x000001E536400000-0x000001E53640A000-memory.dmp
memory/3032-24-0x000001E536CD0000-0x000001E5371F8000-memory.dmp
memory/3032-23-0x000001E5365D0000-0x000001E536792000-memory.dmp
memory/3032-22-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-21-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-20-0x000001E536440000-0x000001E536464000-memory.dmp
memory/3032-0-0x00007FFC242BF000-0x00007FFC242C0000-memory.dmp
memory/3032-26-0x000001E536480000-0x000001E53649A000-memory.dmp
memory/3032-7-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-29-0x000001E536470000-0x000001E536476000-memory.dmp
memory/3032-11-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-30-0x000001E5364A0000-0x000001E5364AA000-memory.dmp
memory/3032-28-0x000001E536460000-0x000001E536468000-memory.dmp
memory/3032-27-0x000001E536540000-0x000001E53656A000-memory.dmp
memory/3032-25-0x000001E537410000-0x000001E537614000-memory.dmp
memory/3032-33-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-35-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-36-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-38-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-37-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-40-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-43-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-2-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-6-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-5-0x000001E535550000-0x000001E535572000-memory.dmp
memory/3032-1-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp
memory/3032-366-0x00007FFC24130000-0x00007FFC24AD4000-memory.dmp