aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6

General

Target

aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe
Size

540KB
MD5

eed5e12384f85ac26c3edb122937ed8c
SHA1

53c7bdcb14c09ffa241e4565e35ba47c9353fa5a
SHA256

aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6
SHA512

5f15c336d65bd6e1be2e635222052cdca56246cb8517154a466026da63b3a6a62022d51054e102d5b1d788bbaff8d8e88908c7fcf605f5ef0a0b28d3d27b3604
SSDEEP

12288:k5OAJOt1yGIJ7Ut8NxXLJyg1dKEX1a1U0cMJXhs+lKN366W:kIAob87Ut87tRBeVXy+lKNK6W

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
844	QQhash.exe

Loads dropped DLL 6 IoCs

pid	Process
1204	aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe
1204	aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe
1736	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1736	844	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 844	1204	aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe	27
PID 1204 wrote to memory of 844	1204	aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe	27
PID 1204 wrote to memory of 844	1204	aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe	27
PID 1204 wrote to memory of 844	1204	aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe	27
PID 844 wrote to memory of 1736	844	QQhash.exe	28
PID 844 wrote to memory of 1736	844	QQhash.exe	28
PID 844 wrote to memory of 1736	844	QQhash.exe	28
PID 844 wrote to memory of 1736	844	QQhash.exe	28

C:\Users\Admin\AppData\Local\Temp\aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe
"C:\Users\Admin\AppData\Local\Temp\aecef9243c2a7e6bd80fddbf4df15ce3b1c19d7388ca440f87baefe26118a4d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windowssystem32\QQhash.exe
  "C:\Windowssystem32\QQhash.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 844 -s 96
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
\Windowssystem32\QQhash.exe

Filesize
432KB

MD5
be04a7ef973d3f4dbb3b457ad86745f6

SHA1
63cb99a7f0f317f6b2c24f99338ff4c0970b3bc9

SHA256
10a9ce1e6849e8a68a591e32f365399107f4c4e8b243b634326bdce2d40c4312

SHA512
19c7de75269e6bdab414a945940f1504c09944ad2613e451adadafbbd5931e1f4eed29411c67e1ad1dea098cdd3c9f23585245680529baa51793d92b4ff6228c

Download Submit
memory/844-64-0x0000000000400000-0x000000000059C000-memory.dmp

Filesize
1.6MB

Download
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing