2b6f5f6737b1eddf6ea7eac1b19d5fa69e40605d9e2cff11a2a1b9648d544f2f

Analysis

max time kernel
149s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Primo-Ramdisk-Server-Edition-6.6.0/PRD660Pv3-Patch/install.bat
Size 3KB
Sample260805-d47dnach37
SHA256 2b6f5f6737b1eddf6ea7eac1b19d5fa69e40605d9e2cff11a2a1b9648d544f2f
MD5 3933b86b62a093fbef6d7c9c750ec53d
SHA1 517148b96beb6bd63f3f40b295b5a4ed0f9fdbe6
SHA512 9e41e6a0e3a11319a5c3d4d54c7849726fd7b1a80bf5b4e2250825e4ce0db86646ba321e265946bf935beb8f7f93a99ee0a220744bcffdb806fc8e209e545168
TLSH
T105514140B008043702B567FF84BAE1EBBADD118F8B742BF0B1E311B5571B39875AE196
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4688	cmd.exe
1808	cmd.exe
5300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CmdColor.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1320	reg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 5528	4688	cmd.exe	87
PID 4688 wrote to memory of 5284	4688	cmd.exe	88
PID 4688 wrote to memory of 5920	4688	cmd.exe	89
PID 4688 wrote to memory of 1808	4688	cmd.exe	90
PID 4688 wrote to memory of 5300	4688	cmd.exe	91
PID 5300 wrote to memory of 1320	5300	cmd.exe	92
PID 4688 wrote to memory of 3316	4688	cmd.exe	93
PID 4688 wrote to memory of 3512	4688	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Primo-Ramdisk-Server-Edition-6.6.0\PRD660Pv3-Patch\install.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\system32\chcp.com
  chcp 936
  2⤵
  PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo \033[93m本补丁仅针对Primo Ramdisk 6.6.0和64位版Windows 7/10/11。"
  2⤵
  PID:5284
- C:\Users\Admin\AppData\Local\Temp\Primo-Ramdisk-Server-Edition-6.6.0\PRD660Pv3-Patch\CmdColor.exe
  cmdcolor
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{94B97E1E-9B67-4012-A126-6319E211A298}_is1 /v InstallLocation
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\system32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{94B97E1E-9B67-4012-A126-6319E211A298}_is1 /v InstallLocation
    3⤵
    - Modifies registry key
    PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo \033[91m未发现Primo Ramdisk的安装文件夹。"
  2⤵
  PID:3316
- C:\Users\Admin\AppData\Local\Temp\Primo-Ramdisk-Server-Edition-6.6.0\PRD660Pv3-Patch\CmdColor.exe
  cmdcolor
  2⤵
  PID:3512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads