bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldperm cracked.exe
Size 3.4MB
Sample260705-zzb8lsfx5s
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe
3960	powershell.exe
1504	powershell.exe
1220	powershell.exe
2788	powershell.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2736	powershell.exe
2736	powershell.exe
3960	powershell.exe
3960	powershell.exe
1504	powershell.exe
1504	powershell.exe
1220	powershell.exe
1220	powershell.exe
2788	powershell.exe
2788	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2332	coldperm cracked.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeIncreaseQuotaPrivilege	2736	powershell.exe
Token: SeSecurityPrivilege	2736	powershell.exe
Token: SeTakeOwnershipPrivilege	2736	powershell.exe
Token: SeLoadDriverPrivilege	2736	powershell.exe
Token: SeSystemProfilePrivilege	2736	powershell.exe
Token: SeSystemtimePrivilege	2736	powershell.exe
Token: SeProfSingleProcessPrivilege	2736	powershell.exe
Token: SeIncBasePriorityPrivilege	2736	powershell.exe
Token: SeCreatePagefilePrivilege	2736	powershell.exe
Token: SeBackupPrivilege	2736	powershell.exe
Token: SeRestorePrivilege	2736	powershell.exe
Token: SeShutdownPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeSystemEnvironmentPrivilege	2736	powershell.exe
Token: SeRemoteShutdownPrivilege	2736	powershell.exe
Token: SeUndockPrivilege	2736	powershell.exe
Token: SeManageVolumePrivilege	2736	powershell.exe
Token: 33	2736	powershell.exe
Token: 34	2736	powershell.exe
Token: 35	2736	powershell.exe
Token: 36	2736	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeIncreaseQuotaPrivilege	3960	powershell.exe
Token: SeSecurityPrivilege	3960	powershell.exe
Token: SeTakeOwnershipPrivilege	3960	powershell.exe
Token: SeLoadDriverPrivilege	3960	powershell.exe
Token: SeSystemProfilePrivilege	3960	powershell.exe
Token: SeSystemtimePrivilege	3960	powershell.exe
Token: SeProfSingleProcessPrivilege	3960	powershell.exe
Token: SeIncBasePriorityPrivilege	3960	powershell.exe
Token: SeCreatePagefilePrivilege	3960	powershell.exe
Token: SeBackupPrivilege	3960	powershell.exe
Token: SeRestorePrivilege	3960	powershell.exe
Token: SeShutdownPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeSystemEnvironmentPrivilege	3960	powershell.exe
Token: SeRemoteShutdownPrivilege	3960	powershell.exe
Token: SeUndockPrivilege	3960	powershell.exe
Token: SeManageVolumePrivilege	3960	powershell.exe
Token: 33	3960	powershell.exe
Token: 34	3960	powershell.exe
Token: 35	3960	powershell.exe
Token: 36	3960	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe
Token: SeRemoteShutdownPrivilege	1504	powershell.exe
Token: SeUndockPrivilege	1504	powershell.exe
Token: SeManageVolumePrivilege	1504	powershell.exe
Token: 33	1504	powershell.exe
Token: 34	1504	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2332	coldperm cracked.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 5216	2332	coldperm cracked.exe	89
PID 5216 wrote to memory of 2736	5216	cmd.exe	91
PID 2332 wrote to memory of 6012	2332	coldperm cracked.exe	92
PID 6012 wrote to memory of 3960	6012	cmd.exe	94
PID 2332 wrote to memory of 4204	2332	coldperm cracked.exe	95
PID 4204 wrote to memory of 1504	4204	cmd.exe	97
PID 2332 wrote to memory of 760	2332	coldperm cracked.exe	98
PID 760 wrote to memory of 1220	760	cmd.exe	100
PID 2332 wrote to memory of 4568	2332	coldperm cracked.exe	101
PID 4568 wrote to memory of 2788	4568	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe
"C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1220
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3bab0cc7928f4e67af63c7f823c5c403762e2144ccd5522c0c873a0b2686f4a0
MD5 976bf2c40f3782a7c367ef2a465adee5
SHA1 cdbc4ca3cb85adb7681690b8d44be383442982f3
SHA512 66354a12b607dff8d61efb537a30a77af9ada185f469368730ed974e439ac87a7c53fa2b40fee976dd22bb1810f8dd82e08c1541509c837ceac284fa5a70e784
TLSH
T112219837F3DC8224DC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b607578f9516d749c7278af5a3bc2d077bb6b4a219c7015d61183c93e779f5fc
MD5 9890b6dce801fe49a494671fc0d3275a
SHA1 ba464dc25596142b86fda272df5e27dd681f92cf
SHA512 44aea9f81a8fb5252da9d138080478ba8b7ce2df8ef1d7ba087324688eb95cd208fd4fc13137b4461747762aee2941d6235509f784213c79fe9bafbaeedb3176
TLSH
T10E214637B3DD8614DCA9403A10DDAD1036B687DB40DECF5B6B85E159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7b2b33af2acd5d9529929c09a18c2a72ca2634bdefddca82a4b59e72d19d3f2
MD5 7eb205b68dfe290b1822dcd097eeaa84
SHA1 0881c5bf33c9452f543d082c1cae924423e27741
SHA512 b73a449551aa504131065725a8dd83eb4638b378344502826e2c1f078936cf67daacdb0df8f61ab9059d0d3f8374404adf64c718209719210b3ee76f20ae242d
TLSH
T138219833F3DC8224CC99013A10DDAC1036B6C7CB40DECF9B6B81E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tu5bwpjr.3l0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tu5bwpjr.3l0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2736-7-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-15-0x000001C8B38F0000-0x000001C8B391A000-memory.dmp

Download

memory/2736-9-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-12-0x000001C8B3680000-0x000001C8B369E000-memory.dmp

Download

memory/2736-13-0x000001C8B36A0000-0x000001C8B3752000-memory.dmp

Download

memory/2736-14-0x000001C8B3760000-0x000001C8B376A000-memory.dmp

Download

memory/2736-16-0x000001C8B38F0000-0x000001C8B3914000-memory.dmp

Download

memory/2736-8-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-19-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-18-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-0-0x00007FFB0ABAF000-0x00007FFB0ABB0000-memory.dmp

Download

memory/2736-6-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-5-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download

memory/2736-2-0x000001C8B3360000-0x000001C8B3382000-memory.dmp

Download

memory/2736-1-0x00007FFB0AA20000-0x00007FFB0B3C4000-memory.dmp

Download