2ecafd8cc31c43c6eb82587850cb21e2748f2d88e92d94792689fade5555823e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 16:54

Target

PrimoCache/reg/install.bat
Size

3KB
MD5

b80700284242156e058405a7a5dca822
SHA1

55f0ac2603e25b148d4c2c50bb0ba3519ac0f041
SHA256

899cbb3e5f112987bd4d98b032c27735c87d5266b17e737d86a7e913c3e5d711
SHA512

d73081e80d8c96bf3287ea65a439e4bdee0ab08bb91733825934437f51619cdcf96cc311cbc567c2e2c690f087dbfd9cb325a9d9d2afea7db4418854978554fa

Score

1^/10

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
4496	reg.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 920	3876	cmd.exe	84
PID 3876 wrote to memory of 920	3876	cmd.exe	84
PID 3876 wrote to memory of 1028	3876	cmd.exe	85
PID 3876 wrote to memory of 1028	3876	cmd.exe	85
PID 3876 wrote to memory of 4508	3876	cmd.exe	86
PID 3876 wrote to memory of 4508	3876	cmd.exe	86
PID 4508 wrote to memory of 4496	4508	cmd.exe	87
PID 4508 wrote to memory of 4496	4508	cmd.exe	87
PID 3876 wrote to memory of 716	3876	cmd.exe	88
PID 3876 wrote to memory of 716	3876	cmd.exe	88
PID 3876 wrote to memory of 1560	3876	cmd.exe	89
PID 3876 wrote to memory of 1560	3876	cmd.exe	89
PID 3876 wrote to memory of 1560	3876	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PrimoCache\reg\install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\system32\chcp.com
  chcp 936
  2⤵
  PID:920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A37EA43-BF6F-4DB7-83DB-97AA19BF9408}_is1 /v InstallLocation
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A37EA43-BF6F-4DB7-83DB-97AA19BF9408}_is1 /v InstallLocation
    3⤵
    - Modifies registry key
    PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo \033[91m系统中没有正常安装PrimoCache。"
  2⤵
  PID:716
- C:\Users\Admin\AppData\Local\Temp\PrimoCache\reg\CmdColor.exe
  cmdcolor
  2⤵
  PID:1560

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact