0db9ac02645846b5033b403a818544371046214bfedef7e70d44f5f825713c00 | Triage

Analysis

max time kernel
148s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 08:59

Sharing

Report Analysis Logs

General

Target

rime-install.bat
Size

10KB
MD5

e66b05c5be11e99ae6da714ee1a09fc4
SHA1

b984b31f6e7cc9d4bd5bf0c4f75399218da9387b
SHA256

13687b87072f72cd9ca3813cbf6857375d8f6c472387c44a1ff2f4d16d58947c
SHA512

6976030e669af5389c4dfa9929c85f341910cbe65264a7317d64bd0c1f4fa6dcd605bde20322a5a498c3499ea79cd7a0176fd5547284da8785285c13b7de08dd
SSDEEP

192:M24/vL2Bbn0a+vx0ADv5vPDRiO6QvDkBt4yUFWDeYUWCP+DvJvOzSknbk:F4cnX/0dRiO6XCFWexWYIJGjk

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2440	1884	cmd.exe	88
PID 1884 wrote to memory of 2440	1884	cmd.exe	88
PID 1884 wrote to memory of 5052	1884	cmd.exe	90
PID 1884 wrote to memory of 5052	1884	cmd.exe	90
PID 1884 wrote to memory of 3288	1884	cmd.exe	91
PID 1884 wrote to memory of 3288	1884	cmd.exe	91
PID 1884 wrote to memory of 4468	1884	cmd.exe	92
PID 1884 wrote to memory of 4468	1884	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\rime-install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\where.exe
  where /q 7z
  2⤵
  PID:2440
- C:\Windows\system32\where.exe
  where /q git
  2⤵
  PID:5052
- C:\Windows\system32\where.exe
  where /q bash
  2⤵
  PID:3288
- C:\Windows\system32\where.exe
  where /q curl
  2⤵
  PID:4468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads