21c3dda1705a30f4d677e8bfbda332ca184e75fa377bf83e64e579209f360962 | Triage

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 20:42

Sharing

Report Analysis Logs

General

Target

OpenAcrylicHostsFile.bat
Size

63B
MD5

eae9e960f0321dc92b1ceabbfcbd2870
SHA1

90d13ec738de42ba9a68774fd72f9f3dc13b498f
SHA256

be0836499a5d92f76b367a41e3ac971330acb18313c76b4720a0f8480e4bee9a
SHA512

310afae95917ff939d9ac9561816564574e8c3adc2442ecbd3eb858aa05503b0df7d1d99cde9b7d2822277215d85a74e3e713dd47e852f2a92a0c3572ad55581

Score

1^/10

Malware Config

Signatures

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

AcrylicUI.exe

pid process

2760 AcrylicUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AcrylicUI.exe

pid	process
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe
2760	AcrylicUI.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 4860 wrote to memory of 2760	4860	cmd.exe	AcrylicUI.exe
PID 4860 wrote to memory of 2760	4860	cmd.exe	AcrylicUI.exe
PID 4860 wrote to memory of 2760	4860	cmd.exe	AcrylicUI.exe
PID 4860 wrote to memory of 2760	4860	cmd.exe	AcrylicUI.exe
PID 4860 wrote to memory of 2760	4860	cmd.exe	AcrylicUI.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\OpenAcrylicHostsFile.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860

C:\Users\Admin\AppData\Local\Temp\AcrylicUI.exe
AcrylicUI.exe OpenAcrylicHostsFile
2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
PID:2760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2760-1-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/2760-3-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download