Overview

overview

3

Static

static

3

Scald Prem...1).exe

windows10-2004-x64

3

Scald Prem...1).exe

windows11-21h2-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    66s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/05/2026, 03:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Scald Premium (1) (1) (1) (1).exe
  • Size 7.0MB
  • Sample260504-dk76vabw2z
  • SHA256 a6f463d2e9c05cd6e5bb7b65149c2a1055f3f24f43207db4119ff71c9f2d8016
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scald Premium (1) (1) (1) (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Scald Premium (1) (1) (1) (1).exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Get-WmiObject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Get-WmiObject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4952
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Get-WmiObject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Get-WmiObject Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2464

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        powershell.exe.log
        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        • Size 3KB
        • SHA256 7c6c09f48f03421430d707d27632810414e5e2bf2eecd5eb675fecf8b45a9a92
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 6a6f7a56ec1088ade2c4018be88ae88bf1759de1efd9ac020fe14852d4e7f805
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_zrianpfk.mxj.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zrianpfk.mxj.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1716-0-0x00007FF75E4F0000-0x00007FF75EBF4000-memory.dmp
        Download

        memory/1716-26-0x0000020926290000-0x00000209262A0000-memory.dmp
        Download

        memory/1716-27-0x000002090BF70000-0x000002090BF7C000-memory.dmp
        Download

        memory/1716-28-0x0000020926290000-0x00000209262A0000-memory.dmp
        Download

        memory/2464-25-0x0000019166390000-0x00000191663A2000-memory.dmp
        Download

        memory/2464-24-0x0000019164800000-0x000001916480C000-memory.dmp
        Download

        memory/4952-9-0x0000027A0A9F0000-0x0000027A0AA12000-memory.dmp
        Download

        memory/4952-10-0x0000027A22C00000-0x0000027A22C10000-memory.dmp
        Download

        memory/4952-13-0x0000027A08D10000-0x0000027A08D1C000-memory.dmp
        Download

        memory/4952-14-0x0000027A0A980000-0x0000027A0A992000-memory.dmp
        Download

        memory/4952-1-0x0000027A22C00000-0x0000027A22C10000-memory.dmp
        Download

        memory/4952-2-0x0000027A22C00000-0x0000027A22C10000-memory.dmp
        Download