21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962 | Triage

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:42

Sharing

Report Analysis Logs

General

Target

OpenAcrylicHostsFile.bat
Size

63B
MD5

eae9e960f0321dc92b1ceabbfcbd2870
SHA1

90d13ec738de42ba9a68774fd72f9f3dc13b498f
SHA256

be0836499a5d92f76b367a41e3ac971330acb18313c76b4720a0f8480e4bee9a
SHA512

310afae95917ff939d9ac9561816564574e8c3adc2442ecbd3eb858aa05503b0df7d1d99cde9b7d2822277215d85a74e3e713dd47e852f2a92a0c3572ad55581

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

AcrylicUI.exe

pid process

1708 AcrylicUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AcrylicUI.exe

pid	process
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe
1708	AcrylicUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2288 wrote to memory of 1708	2288	cmd.exe	AcrylicUI.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	AcrylicUI.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	AcrylicUI.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	AcrylicUI.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	AcrylicUI.exe
PID 2288 wrote to memory of 1708	2288	cmd.exe	AcrylicUI.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OpenAcrylicHostsFile.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Users\Admin\AppData\Local\Temp\AcrylicUI.exe
AcrylicUI.exe OpenAcrylicHostsFile
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1708-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/1708-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download