21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InstallAcrylicService.bat
Size

46B
MD5

55ea51628ff67e4ee11a7f2685a32d2f
SHA1

243d144602cce10414aac73fd4ca9536fe535db9
SHA256

d2f7679e5097ed1a9aeadb7af86ed7705fe96ace3a7e58996c0d3ab20b69182e
SHA512

c5d4c0dc3ce6b7858753584ba48d19feaf9b4f834724a798f005763b06aa83740400066ee914a4c2823f5c0b5eb054255968e1b2069588ab04dd032bd591f0e8

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AcrylicService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AcrylicDNSProxySvc\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AcrylicService.exe\""	AcrylicService.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

ICACLS.exeICACLS.exe

pid process

1808 ICACLS.exe
1420 ICACLS.exe
Runs net.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

AcrylicUI.exe

pid process

4496 AcrylicUI.exe

pid	process
1808	ICACLS.exe
1420	ICACLS.exe

pid	process
4496	AcrylicUI.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

cmd.exeAcrylicUI.exeNet.exe

description	pid	process	target process
PID 4048 wrote to memory of 4496	4048	cmd.exe	AcrylicUI.exe
PID 4048 wrote to memory of 4496	4048	cmd.exe	AcrylicUI.exe
PID 4048 wrote to memory of 4496	4048	cmd.exe	AcrylicUI.exe
PID 4048 wrote to memory of 4496	4048	cmd.exe	AcrylicUI.exe
PID 4048 wrote to memory of 4496	4048	cmd.exe	AcrylicUI.exe
PID 4496 wrote to memory of 1132	4496	AcrylicUI.exe	AcrylicService.exe
PID 4496 wrote to memory of 1132	4496	AcrylicUI.exe	AcrylicService.exe
PID 4496 wrote to memory of 1132	4496	AcrylicUI.exe	AcrylicService.exe
PID 4496 wrote to memory of 1808	4496	AcrylicUI.exe	ICACLS.exe
PID 4496 wrote to memory of 1808	4496	AcrylicUI.exe	ICACLS.exe
PID 4496 wrote to memory of 1808	4496	AcrylicUI.exe	ICACLS.exe
PID 4496 wrote to memory of 1420	4496	AcrylicUI.exe	ICACLS.exe
PID 4496 wrote to memory of 1420	4496	AcrylicUI.exe	ICACLS.exe
PID 4496 wrote to memory of 1420	4496	AcrylicUI.exe	ICACLS.exe
PID 4496 wrote to memory of 3392	4496	AcrylicUI.exe	Net.exe
PID 4496 wrote to memory of 3392	4496	AcrylicUI.exe	Net.exe
PID 4496 wrote to memory of 3392	4496	AcrylicUI.exe	Net.exe
PID 3392 wrote to memory of 4176	3392	Net.exe	net1.exe
PID 3392 wrote to memory of 4176	3392	Net.exe	net1.exe
PID 3392 wrote to memory of 4176	3392	Net.exe	net1.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\InstallAcrylicService.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\AcrylicUI.exe
AcrylicUI.exe InstallAcrylicService
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:4496

C:\Users\Admin\AppData\Local\Temp\AcrylicService.exe
"C:\Users\Admin\AppData\Local\Temp\AcrylicService.exe" /INSTALL /SILENT
3⤵
- Sets service image path in registry
PID:1132

C:\Windows\SysWOW64\ICACLS.exe
ICACLS.exe "C:\Users\Admin\AppData\Local\Temp\AcrylicService.exe" /inheritance:d
3⤵
- Modifies file permissions
PID:1808

C:\Windows\SysWOW64\ICACLS.exe
ICACLS.exe "C:\Users\Admin\AppData\Local\Temp\AcrylicService.exe" /remove:g "Authenticated Users"
3⤵
- Modifies file permissions
PID:1420

C:\Windows\SysWOW64\Net.exe
Net.exe Start AcrylicDNSProxySvc
3⤵
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 Start AcrylicDNSProxySvc
4⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\AcrylicService.exe
"C:\Users\Admin\AppData\Local\Temp\AcrylicService.exe"
1⤵
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4500 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:2332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=560 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5380 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5436 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5260 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --mojo-platform-channel-handle=5496 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:1
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1132-1-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1132-2-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/3816-3-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/3816-5-0x0000000000400000-0x00000000007C3000-memory.dmp

Filesize
3.8MB

Download
memory/4496-0-0x0000000002250000-0x0000000002251000-memory.dmp

Filesize
4KB

Download
memory/4496-4-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download