flawedammyy | 96feb1ddff0a9845114a0f963faf7740876135ac82c4102c35a40c36fa54cbd9

Analysis

max time kernel
151s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-05-2023 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Device/HarddiskVolume6/UB_AHO_AG/albinopm/SCAN/Animol Lukose/jpeg/sent/AA_v3.5.exe
Size

746KB
MD5

f8cd52b70a11a1fb3f29c6f89ff971ec
SHA1

6a0c46818a6a10c2c5a98a0cce65fbaf95caa344
SHA256

6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
SHA512

987b6b288a454b6198d4e7f94b7bba67cafe37f9654cd3cd72134a85958efd2125596ae48e66a8ee49ee3f4199dac7f136e1831f2bf4015f25d2980f0b866abe
SSDEEP

12288:PUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjcP6gX:zpJJWOwlaUPcWWwRZb4Rt+N5WMasHoX

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AA_v3.5.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Control Panel\International\Geo\Nation	AA_v3.5.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

AA_v3.5.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	AA_v3.5.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953e7f0c8aec321b16b	AA_v3.5.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 902cb03a464ac3034c90cc06955849be569a598e22d2795112e38883cb7d105e829b4e3a3e8ad2aa194432e495879cccb59a6ac1a4f609c217915deec23d5b0b2561c68b	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AA_v3.5.exe

pid	Process
1936	AA_v3.5.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

AA_v3.5.exe

pid	Process
1936	AA_v3.5.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AA_v3.5.exe

description	pid	Process	procid_target
PID 1992 wrote to memory of 1936	1992	AA_v3.5.exe	29
PID 1992 wrote to memory of 1936	1992	AA_v3.5.exe	29
PID 1992 wrote to memory of 1936	1992	AA_v3.5.exe	29
PID 1992 wrote to memory of 1936	1992	AA_v3.5.exe	29

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\UB_AHO_AG\albinopm\SCAN\Animol Lukose\jpeg\sent\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\UB_AHO_AG\albinopm\SCAN\Animol Lukose\jpeg\sent\AA_v3.5.exe"
1⤵
PID:1084

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\UB_AHO_AG\albinopm\SCAN\Animol Lukose\jpeg\sent\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\UB_AHO_AG\albinopm\SCAN\Animol Lukose\jpeg\sent\AA_v3.5.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\UB_AHO_AG\albinopm\SCAN\Animol Lukose\jpeg\sent\AA_v3.5.exe
  "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume6\UB_AHO_AG\albinopm\SCAN\Animol Lukose\jpeg\sent\AA_v3.5.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
ba0247afbcf6098cd4f1744d6cdea7a2

SHA1
87d2e6777b1216cdad3c12f595ceb9dc97498448

SHA256
6e59b247013983793d175a225c07d2bff7708c9778649a614859a8ae3eaff3bf

SHA512
a978d9b097518affb33791a0f74c83dac606eda7f04d9800b70cd55626548d41b45d584f367b89011582fb79bd04e44aa825d17978731454ed0bbd613d4f9a83

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
8354eaceb233fef5e1bf65d69b6aec8c

SHA1
3a4fad8373ef0238a2f1b739ceaa9d45a2ee8e1e

SHA256
5b20db0031a3e2210c0bf2a1d11b92843cb23e0ec3eeab40baafe2f27cad71db

SHA512
bdf6587045e43ab0a53d1eca34b1920d7a56ac77d02ffc22b537d09ef26648a7791927f3d9a1fff131054372e9be81bc1abc674cdb53f2e1ee757cd7c8288506

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit