resource	yara_rule
behavioral3/memory/728-206-0x0000000000400000-0x0000000001115000-memory.dmp	family_ammyyadmin
behavioral3/files/0x0006000000022e3d-209.dat	family_ammyyadmin

pid	Process
4460	flawedammyy.exe
4460	flawedammyy.exe
4460	flawedammyy.exe
4460	flawedammyy.exe
4460	flawedammyy.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	flawedammyy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SinTech client = "C:\\Program Files (x86)\\SinTech\\TextEdit.exe"	flawedammyy.exe

pid	Process
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe
728	wlanspeed.exe

description	ioc	Process
File created	C:\Program Files (x86)\SinTech\TextEdit.exe	flawedammyy.exe
File created	C:\Program Files (x86)\SinTech\TextEdit.exe.config	flawedammyy.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	flawedammyy.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Recovery	flawedammyy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShownTime = f84268cb0c09d401	flawedammyy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10TourShown = "1"	flawedammyy.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043099a93b0a2dd41b22bfbb30670caee000000000200000000001066000000010000200000008954adbbaeaf64812d2508db4ebfbde9d2cc00c7cd588cdbc2a9b937138d84ba000000000e800000000200002000000093b233e491f87d652f363b3e2ec5f26e2c972d0271ede0341b8b596da6cab0f120000000058eabeb4ae0fa872017310b894d9d2930200eddca9e22a4a29ac9f2ed6e079b4000000064ca7c578adf2019a6ebc5cc8de11114edc995645ff080823ea5ac6d40782fdfd47455d659799069a1b95fac7ecdc8f1daafe3415f25e16c8fbe4d1e573bb9ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1931809216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1931809216"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1961183963"	IEXPLORE.EXE
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main	flawedammyy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown_TIMESTAMP = 232ab69ccc22d401	flawedammyy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceCompletionTime = f84268cb0c09d401	flawedammyy.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362850055"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	flawedammyy.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c29768e087d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30967776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30967776"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOnceLastShown = "1"	flawedammyy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\IE10RunOncePerInstallCompleted = "1"	flawedammyy.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30967776"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"	flawedammyy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9E54F9F1-F3D3-11EC-A58B-46F9D3C81F08} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

pid	Process
1856	iexplore.exe
1856	iexplore.exe
728	wlanspeed.exe
2020	IEXPLORE.EXE
2020	IEXPLORE.EXE
1856	iexplore.exe
1856	iexplore.exe
3804	IEXPLORE.EXE
3804	IEXPLORE.EXE

description	pid	Process	procid_target
PID 4460 wrote to memory of 3456	4460	flawedammyy.exe	81
PID 4460 wrote to memory of 3456	4460	flawedammyy.exe	81
PID 4460 wrote to memory of 1584	4460	flawedammyy.exe	82
PID 4460 wrote to memory of 1584	4460	flawedammyy.exe	82
PID 4460 wrote to memory of 1584	4460	flawedammyy.exe	82
PID 1584 wrote to memory of 2800	1584	cmd.exe	84
PID 1584 wrote to memory of 2800	1584	cmd.exe	84
PID 1584 wrote to memory of 2800	1584	cmd.exe	84
PID 1584 wrote to memory of 4948	1584	cmd.exe	85
PID 1584 wrote to memory of 4948	1584	cmd.exe	85
PID 1584 wrote to memory of 4948	1584	cmd.exe	85
PID 1584 wrote to memory of 1624	1584	cmd.exe	86
PID 1584 wrote to memory of 1624	1584	cmd.exe	86
PID 1584 wrote to memory of 1624	1584	cmd.exe	86
PID 1856 wrote to memory of 2020	1856	iexplore.exe	89
PID 1856 wrote to memory of 2020	1856	iexplore.exe	89
PID 1856 wrote to memory of 2020	1856	iexplore.exe	89
PID 1584 wrote to memory of 4416	1584	cmd.exe	90
PID 1584 wrote to memory of 4416	1584	cmd.exe	90
PID 1584 wrote to memory of 4416	1584	cmd.exe	90
PID 4460 wrote to memory of 728	4460	flawedammyy.exe	91
PID 4460 wrote to memory of 728	4460	flawedammyy.exe	91
PID 4460 wrote to memory of 728	4460	flawedammyy.exe	91
PID 1856 wrote to memory of 3804	1856	iexplore.exe	96
PID 1856 wrote to memory of 3804	1856	iexplore.exe	96
PID 1856 wrote to memory of 3804	1856	iexplore.exe	96
PID 4460 wrote to memory of 5076	4460	flawedammyy.exe	103
PID 4460 wrote to memory of 5076	4460	flawedammyy.exe	103
PID 4460 wrote to memory of 5076	4460	flawedammyy.exe	103

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads