2ecafd8cc31c43c6eb82587850cb21e2748f2d88e92d94792689fade5555823e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PrimoCache/reg/install.bat
Size

3KB
MD5

b80700284242156e058405a7a5dca822
SHA1

55f0ac2603e25b148d4c2c50bb0ba3519ac0f041
SHA256

899cbb3e5f112987bd4d98b032c27735c87d5266b17e737d86a7e913c3e5d711
SHA512

d73081e80d8c96bf3287ea65a439e4bdee0ab08bb91733825934437f51619cdcf96cc311cbc567c2e2c690f087dbfd9cb325a9d9d2afea7db4418854978554fa

Score

1^/10

Malware Config

Signatures

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2908	reg.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2400	CmdColor.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1396	2900	cmd.exe	29
PID 2900 wrote to memory of 1396	2900	cmd.exe	29
PID 2900 wrote to memory of 1396	2900	cmd.exe	29
PID 2900 wrote to memory of 464	2900	cmd.exe	30
PID 2900 wrote to memory of 464	2900	cmd.exe	30
PID 2900 wrote to memory of 464	2900	cmd.exe	30
PID 2900 wrote to memory of 848	2900	cmd.exe	31
PID 2900 wrote to memory of 848	2900	cmd.exe	31
PID 2900 wrote to memory of 848	2900	cmd.exe	31
PID 848 wrote to memory of 2908	848	cmd.exe	32
PID 848 wrote to memory of 2908	848	cmd.exe	32
PID 848 wrote to memory of 2908	848	cmd.exe	32
PID 2900 wrote to memory of 1528	2900	cmd.exe	33
PID 2900 wrote to memory of 1528	2900	cmd.exe	33
PID 2900 wrote to memory of 1528	2900	cmd.exe	33
PID 2900 wrote to memory of 2400	2900	cmd.exe	34
PID 2900 wrote to memory of 2400	2900	cmd.exe	34
PID 2900 wrote to memory of 2400	2900	cmd.exe	34
PID 2900 wrote to memory of 2400	2900	cmd.exe	34

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PrimoCache\reg\install.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\chcp.com
  chcp 936
  2⤵
  PID:1396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A37EA43-BF6F-4DB7-83DB-97AA19BF9408}_is1 /v InstallLocation
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A37EA43-BF6F-4DB7-83DB-97AA19BF9408}_is1 /v InstallLocation
    3⤵
    - Modifies registry key
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo \033[91m╧╡═│╓╨├╗╙╨╒²│ú░▓╫░PrimoCacheíú"
  2⤵
  PID:1528
- C:\Users\Admin\AppData\Local\Temp\PrimoCache\reg\CmdColor.exe
  cmdcolor
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...