Overview

overview

8

Static

static

3

coldperm c...ed.exe

windows10-2004-x64

8

coldperm c...ed.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    coldperm cracked.zip
  • Size 4.7MB
  • Sample261014-bs8q8sea62
  • SHA256 2bc7f3ffb56b51d39a48f7ca8190b14a274acffec508fd9048952fff0bc99f09
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecution

Malware Config

Targets

    • Target
      coldperm cracked/coldperm cracked.exe
    • Size 6.7MB
    • SHA256 bc6818240b6af1141afadc512960f0dc5b3d4122741c717b6dad1fe73efd8f52
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Uses WMI to collect hardware manufacturer information

      Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks