bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0

Analysis

user interaction
yes
max time kernel
30s
max time network
29s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 21:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldperm cracked.exe
Size 3.4MB
Sample260705-1e7dpafy4s
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1008	powershell.exe
1256	powershell.exe
3244	powershell.exe
956	powershell.exe
2008	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
956	powershell.exe
956	powershell.exe
2008	powershell.exe
2008	powershell.exe
1008	powershell.exe
1008	powershell.exe
1256	powershell.exe
1256	powershell.exe
3244	powershell.exe
3244	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5036	coldperm cracked.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	956	powershell.exe
Token: SeIncreaseQuotaPrivilege	956	powershell.exe
Token: SeSecurityPrivilege	956	powershell.exe
Token: SeTakeOwnershipPrivilege	956	powershell.exe
Token: SeLoadDriverPrivilege	956	powershell.exe
Token: SeSystemProfilePrivilege	956	powershell.exe
Token: SeSystemtimePrivilege	956	powershell.exe
Token: SeProfSingleProcessPrivilege	956	powershell.exe
Token: SeIncBasePriorityPrivilege	956	powershell.exe
Token: SeCreatePagefilePrivilege	956	powershell.exe
Token: SeBackupPrivilege	956	powershell.exe
Token: SeRestorePrivilege	956	powershell.exe
Token: SeShutdownPrivilege	956	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeSystemEnvironmentPrivilege	956	powershell.exe
Token: SeRemoteShutdownPrivilege	956	powershell.exe
Token: SeUndockPrivilege	956	powershell.exe
Token: SeManageVolumePrivilege	956	powershell.exe
Token: 33	956	powershell.exe
Token: 34	956	powershell.exe
Token: 35	956	powershell.exe
Token: 36	956	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeIncreaseQuotaPrivilege	2008	powershell.exe
Token: SeSecurityPrivilege	2008	powershell.exe
Token: SeTakeOwnershipPrivilege	2008	powershell.exe
Token: SeLoadDriverPrivilege	2008	powershell.exe
Token: SeSystemProfilePrivilege	2008	powershell.exe
Token: SeSystemtimePrivilege	2008	powershell.exe
Token: SeProfSingleProcessPrivilege	2008	powershell.exe
Token: SeIncBasePriorityPrivilege	2008	powershell.exe
Token: SeCreatePagefilePrivilege	2008	powershell.exe
Token: SeBackupPrivilege	2008	powershell.exe
Token: SeRestorePrivilege	2008	powershell.exe
Token: SeShutdownPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeSystemEnvironmentPrivilege	2008	powershell.exe
Token: SeRemoteShutdownPrivilege	2008	powershell.exe
Token: SeUndockPrivilege	2008	powershell.exe
Token: SeManageVolumePrivilege	2008	powershell.exe
Token: 33	2008	powershell.exe
Token: 34	2008	powershell.exe
Token: 35	2008	powershell.exe
Token: 36	2008	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeIncreaseQuotaPrivilege	1008	powershell.exe
Token: SeSecurityPrivilege	1008	powershell.exe
Token: SeTakeOwnershipPrivilege	1008	powershell.exe
Token: SeLoadDriverPrivilege	1008	powershell.exe
Token: SeSystemProfilePrivilege	1008	powershell.exe
Token: SeSystemtimePrivilege	1008	powershell.exe
Token: SeProfSingleProcessPrivilege	1008	powershell.exe
Token: SeIncBasePriorityPrivilege	1008	powershell.exe
Token: SeCreatePagefilePrivilege	1008	powershell.exe
Token: SeBackupPrivilege	1008	powershell.exe
Token: SeRestorePrivilege	1008	powershell.exe
Token: SeShutdownPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeSystemEnvironmentPrivilege	1008	powershell.exe
Token: SeRemoteShutdownPrivilege	1008	powershell.exe
Token: SeUndockPrivilege	1008	powershell.exe
Token: SeManageVolumePrivilege	1008	powershell.exe
Token: 33	1008	powershell.exe
Token: 34	1008	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	coldperm cracked.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3132	5036	coldperm cracked.exe	89
PID 3132 wrote to memory of 956	3132	cmd.exe	91
PID 5036 wrote to memory of 5896	5036	coldperm cracked.exe	92
PID 5896 wrote to memory of 2008	5896	cmd.exe	94
PID 5036 wrote to memory of 3780	5036	coldperm cracked.exe	95
PID 3780 wrote to memory of 1008	3780	cmd.exe	97
PID 5036 wrote to memory of 5128	5036	coldperm cracked.exe	98
PID 5128 wrote to memory of 1256	5128	cmd.exe	100
PID 5036 wrote to memory of 2980	5036	coldperm cracked.exe	101
PID 2980 wrote to memory of 3244	2980	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe
"C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1256
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a8f4482a4421f041202bad8b2d6909e2bab048f78a2e39101e84586e7dd10154
MD5 8fdf92b90ef73997a3fa756f67bf06fe
SHA1 efa1c7faf7bc9b2a1f05b1fd6a370938bda90a5e
SHA512 dde8b293a6aa9c2c7fcdd34be49a4100a31c44af54855df662c00fa9c73bc245b828718b054800155d8e71c5a5a78736ff5e9731302cb9a9579067a871066df5
TLSH
T152216837F3DD8614DCA9403A10DDAD1036B6C7DB40DECF5B6B85E259A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1158d48dad74fe7f649c1868569addeabaf92bf2fd94558fab0e2148143d5d2f
MD5 ad1b076dd63825613bc4f1903633dc72
SHA1 f09beb4c6f837a5d3a6cce79843b75c462aeb4ee
SHA512 a17cd5d22861d33729ff96e3919ae5b83decab85a5313db20bfd82d66ed99b29baea130f39fcd225ce6976aefce9111ff0270bec35315b05e6470114f637bab2
TLSH
T1F8219837F3DC8214CCA9003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298CFA0060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0c741c71b6d12a0fc1f3a21ea5e8984368d95ea8027c76c2252fac5ebadc1d95
MD5 e1b5bacfa5c2788f77b8ae6d8f468ce0
SHA1 f71679b9db1d3aa12179f5cbaa6cbfd1a456498f
SHA512 d48cfe41ead8cc723c49c850d90c1c06f5a5ab8212d12a823edcc612bd3d270b251046be9aa1d902d2d7d0d1617ea57c76ff228603655774e66a79edebde5d44
TLSH
T11E216837F3DD8614DCA9403A10DDAD1036B6CBDB40DECF5B6B85E159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_aamdeppw.b5c.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aamdeppw.b5c.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/956-13-0x0000023D26170000-0x0000023D26222000-memory.dmp

Download

memory/956-15-0x0000023D263B0000-0x0000023D263DA000-memory.dmp

Download

memory/956-9-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-0-0x00007FFB9287F000-0x00007FFB92880000-memory.dmp

Download

memory/956-12-0x0000023D25E20000-0x0000023D25E3E000-memory.dmp

Download

memory/956-14-0x0000023D25E40000-0x0000023D25E4A000-memory.dmp

Download

memory/956-16-0x0000023D263B0000-0x0000023D263D4000-memory.dmp

Download

memory/956-8-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-18-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-7-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-6-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-5-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-4-0x00007FFB926F0000-0x00007FFB93094000-memory.dmp

Download

memory/956-3-0x0000023D0DC50000-0x0000023D0DC72000-memory.dmp

Download