Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    03-07-2023 06:27

General

  • Target

    Device/HarddiskVolume2/Rahman/Discoverer/Softwares/Remote connection softwares/AA_v3.5.exe

  • Size

    746KB

  • MD5

    2cbf5657ffd8858a9597f296a60270c2

  • SHA1

    b130611c92788337c4f6bb9e9454ff06eb409166

  • SHA256

    9b3f4d6a9bae4d7f9cfe45e706db8fe4baef51ae12353941e8b1532b231e6eac

  • SHA512

    06339a299c8c9ce55e9b96582e54e0bf9e04f894ceb47c07486adf8b0140c2a01fd0932207aca8112ee0b16ba8711fee9435e37339aafb94f167b5a736ee7d0b

  • SSDEEP

    12288:6NgEvTkYGzXUMA7PTgM0YOg26y4RtcxcUwhqb3omaY80NP6gL:6XTszE7PTgM0YOgA4RtcbwhsSYFVL

Score
10/10

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"
    1⤵
      PID:680
    • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe
      "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe" -service -lunch
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe
        "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume2\Rahman\Discoverer\Softwares\Remote connection softwares\AA_v3.5.exe"
        2⤵
        • Checks computer location settings
        • Modifies data under HKEY_USERS
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:928

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\AMMYY\hr

      Filesize

      22B

      MD5

      aaa83e46bf1bf64a7b6d583095562504

      SHA1

      25c13fb102ace5c91a4349baf4e0309028c8a81e

      SHA256

      161b757ee242b2b9510b6857ac944b378b30bb96bc677ff7279f2748f756eb9b

      SHA512

      0f4f8b2a557ed039f8e10a32f20ccc12d057701b791f374c3f55803410ff4b64d482f1976df3ab4a8fa4c201e1cb1c9d1729a463b7e85695f514ebfd52ab85c4

    • C:\ProgramData\AMMYY\hr3

      Filesize

      68B

      MD5

      767c30a2abee23fc8de6e55a0b814657

      SHA1

      8eeff64b1c208cbe94e96e87c5c2bac7df7f807d

      SHA256

      fc3f0c326116f698258d19c59e44905d455a3df3710234b2ede401c7d83c9e81

      SHA512

      7c5025cb0b32455461a0b5c0d51828efb59adebd7e156cce2b4c06e6b90f803459ff00ad01c38b4478bf999ef2a42406fd63590905fc85142156285784bac53b

    • C:\ProgramData\AMMYY\settings3.bin

      Filesize

      271B

      MD5

      714f2508d4227f74b6adacfef73815d8

      SHA1

      a35c8a796e4453c0c09d011284b806d25bdad04c

      SHA256

      a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

      SHA512

      1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8