bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0

Analysis

user interaction
yes
max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
coldperm cracked.exe
Size 3.4MB
Sample260821-xtjz6abk7z
SHA256 bc0fdd2f7aef0987f944ba0e74064d602b2845a61a4cce3bd054d75848c424d0
MD5 a8f950d90dafd955bd35df41a610367b
SHA1 38095bc25010440a99b7cd1ec68a062cef64f01f
SHA512 723175a95486c7512d2801ae999e2f2d54808be47be6ff02789c3786a79be90f8af145ea81ff32c1e669f2e7e4d36d288aad1c575a374fa7e62e9a097d7ba5d8
SSDEEP 49152:DhyMqPgRBl6IB/0KLkvEfZu4uCqsu7J4bVp4cjACdiQL2KhdpXJM34/7XpyYN:wY5CEfZu4uCqsu7J4REEzZM3QpyY
TLSH
T1CEF5DF2AF7A441E9C47B913CC8A6A707F3B178581731D7DB22E859581F63BE05A3E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4420	powershell.exe
2388	powershell.exe
4712	powershell.exe
2364	powershell.exe
5068	powershell.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3292	cmd.exe
1848	cmd.exe
3776	cmd.exe
5176	cmd.exe
2308	cmd.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4712	powershell.exe
4712	powershell.exe
2364	powershell.exe
2364	powershell.exe
2364	powershell.exe
5068	powershell.exe
5068	powershell.exe
4420	powershell.exe
4420	powershell.exe
2388	powershell.exe
2388	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1272	coldperm cracked.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeIncreaseQuotaPrivilege	4712	powershell.exe
Token: SeSecurityPrivilege	4712	powershell.exe
Token: SeTakeOwnershipPrivilege	4712	powershell.exe
Token: SeLoadDriverPrivilege	4712	powershell.exe
Token: SeSystemProfilePrivilege	4712	powershell.exe
Token: SeSystemtimePrivilege	4712	powershell.exe
Token: SeProfSingleProcessPrivilege	4712	powershell.exe
Token: SeIncBasePriorityPrivilege	4712	powershell.exe
Token: SeCreatePagefilePrivilege	4712	powershell.exe
Token: SeBackupPrivilege	4712	powershell.exe
Token: SeRestorePrivilege	4712	powershell.exe
Token: SeShutdownPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeSystemEnvironmentPrivilege	4712	powershell.exe
Token: SeRemoteShutdownPrivilege	4712	powershell.exe
Token: SeUndockPrivilege	4712	powershell.exe
Token: SeManageVolumePrivilege	4712	powershell.exe
Token: 33	4712	powershell.exe
Token: 34	4712	powershell.exe
Token: 35	4712	powershell.exe
Token: 36	4712	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeIncreaseQuotaPrivilege	2364	powershell.exe
Token: SeSecurityPrivilege	2364	powershell.exe
Token: SeTakeOwnershipPrivilege	2364	powershell.exe
Token: SeLoadDriverPrivilege	2364	powershell.exe
Token: SeSystemProfilePrivilege	2364	powershell.exe
Token: SeSystemtimePrivilege	2364	powershell.exe
Token: SeProfSingleProcessPrivilege	2364	powershell.exe
Token: SeIncBasePriorityPrivilege	2364	powershell.exe
Token: SeCreatePagefilePrivilege	2364	powershell.exe
Token: SeBackupPrivilege	2364	powershell.exe
Token: SeRestorePrivilege	2364	powershell.exe
Token: SeShutdownPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeSystemEnvironmentPrivilege	2364	powershell.exe
Token: SeRemoteShutdownPrivilege	2364	powershell.exe
Token: SeUndockPrivilege	2364	powershell.exe
Token: SeManageVolumePrivilege	2364	powershell.exe
Token: 33	2364	powershell.exe
Token: 34	2364	powershell.exe
Token: 35	2364	powershell.exe
Token: 36	2364	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeIncreaseQuotaPrivilege	5068	powershell.exe
Token: SeSecurityPrivilege	5068	powershell.exe
Token: SeTakeOwnershipPrivilege	5068	powershell.exe
Token: SeLoadDriverPrivilege	5068	powershell.exe
Token: SeSystemProfilePrivilege	5068	powershell.exe
Token: SeSystemtimePrivilege	5068	powershell.exe
Token: SeProfSingleProcessPrivilege	5068	powershell.exe
Token: SeIncBasePriorityPrivilege	5068	powershell.exe
Token: SeCreatePagefilePrivilege	5068	powershell.exe
Token: SeBackupPrivilege	5068	powershell.exe
Token: SeRestorePrivilege	5068	powershell.exe
Token: SeShutdownPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeSystemEnvironmentPrivilege	5068	powershell.exe
Token: SeRemoteShutdownPrivilege	5068	powershell.exe
Token: SeUndockPrivilege	5068	powershell.exe
Token: SeManageVolumePrivilege	5068	powershell.exe
Token: 33	5068	powershell.exe
Token: 34	5068	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1272	coldperm cracked.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 3292	1272	coldperm cracked.exe	90
PID 3292 wrote to memory of 4712	3292	cmd.exe	92
PID 1272 wrote to memory of 1848	1272	coldperm cracked.exe	93
PID 1848 wrote to memory of 2364	1848	cmd.exe	95
PID 1272 wrote to memory of 3776	1272	coldperm cracked.exe	96
PID 3776 wrote to memory of 5068	3776	cmd.exe	98
PID 1272 wrote to memory of 5176	1272	coldperm cracked.exe	99
PID 5176 wrote to memory of 4420	5176	cmd.exe	101
PID 1272 wrote to memory of 2308	1272	coldperm cracked.exe	102
PID 2308 wrote to memory of 2388	2308	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe
"C:\Users\Admin\AppData\Local\Temp\coldperm cracked.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_DiskDrive | Select-Object -First 1).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4340926393e47ae590060abfee64c85f47fd56e5dfc0875f1c701ddc5f517425
MD5 fefc79bf46aec52373426f62b243071b
SHA1 4e9eaa849168f154ce45c0ed9304722253cc4a96
SHA512 2701c74674d1c7caaa29a7b96b25f77efd46604a8e0a032fc78ac99d16c4130eefa2b04054591141f695b70bb48200f53fbf7eebf7d9ab66031cc841290efc71
TLSH
T1CD219833F3DC8614CCAA003A10DDAC1036B6C7DB40DECF9B6B85E159A42F298DFA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a026f1b8af4a855ee8a2f85bb46c249cf4171f67a92db2a92731d38499e35d1b
MD5 a0ea2673292808329e7921a44a4f0cd7
SHA1 8fbf3fb03bb87c99447d980b8b862a23c7fa637a
SHA512 65b2dccb424eb944cf60996e35befca21e01531f071dae8b28b80526c2a9c8508aa7281572a4ded1cfdf1e710a1010fecf025820ec58d288669eb3aeef0f0605
TLSH
T1A0217633F3DC8214C899013A10DDAC1036B687CB40DECF9B6B81E169A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b406304ab44ddfa7799fe675d17c83e02c8368c1f9a6c30ae926ad1f4d2824da
MD5 b79bb325b88d10f5b6361860dea64063
SHA1 7f8179473a66081a7fa4cacf14e3e503818ce05d
SHA512 47bb00615d366f0d1acbc4700ff55a1aaa042b67de0b55df9a41265ef8fa7b098580922fae06cfdca17db351ffd9a443b057b56d815029e28594889ebc6db31b
TLSH
T1C5216B37F3DD8624CC99403610DDAD1036B6C7DB40DECF5B6B85D159A42F699CF61060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a83a237e4fb54393d2257ed2eb40cb666fdce194b7e0257e6b261ad896fbdb4a
MD5 9f616939b3235c0f337f58e76237b57f
SHA1 6ddb2f4f3c788ef78bbe15e7114ba915d97f347d
SHA512 db51adcc7c7ac93bbbc2ea0b454ca20a0a6abfc5084d3cdda68261fd237ff38037b1a6e0a9e53bf0300ad6feed0c847bb997c13e11341720953eadfb6e76c787
TLSH
T1B9217633B3DC8224C899013A10DDAC1036B687CB40DECF9B6B81E159A82F298DF60060
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_msluvauf.din.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_msluvauf.din.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4712-7-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-15-0x00000220647B0000-0x00000220647DA000-memory.dmp

Download

memory/4712-9-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-12-0x0000022064330000-0x000002206434E000-memory.dmp

Download

memory/4712-13-0x0000022064560000-0x0000022064612000-memory.dmp

Download

memory/4712-14-0x0000022064620000-0x000002206462A000-memory.dmp

Download

memory/4712-16-0x00000220647B0000-0x00000220647D4000-memory.dmp

Download

memory/4712-8-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-18-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-19-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-0-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp

Download

memory/4712-6-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-5-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-1-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp

Download

memory/4712-4-0x0000022064270000-0x0000022064292000-memory.dmp

Download

memory/5068-31-0x0000026327C40000-0x0000026327CF2000-memory.dmp

Download