flawedammyy | 0088822bc921738b4ead93e4cdfe4f5d81fdfe9d32a70a27cd26cdc986575468

Analysis

max time kernel
157s
max time network
157s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
09-07-2023 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Device/HarddiskVolume5/MyOld/File_History/[email protected]/LTP-310/Data/C/Users/Santhosh..exe
Size

746KB
MD5

f8cd52b70a11a1fb3f29c6f89ff971ec
SHA1

6a0c46818a6a10c2c5a98a0cce65fbaf95caa344
SHA256

6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
SHA512

987b6b288a454b6198d4e7f94b7bba67cafe37f9654cd3cd72134a85958efd2125596ae48e66a8ee49ee3f4199dac7f136e1831f2bf4015f25d2980f0b866abe
SSDEEP

12288:PUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjcP6gX:zpJJWOwlaUPcWWwRZb4Rt+N5WMasHoX

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000\Control Panel\International\Geo\Nation	Santhosh..exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Santhosh..exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	Santhosh..exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	Santhosh..exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	Santhosh..exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c10595397278dee45edb16b	Santhosh..exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 4d95fe12f193d1093c4d2129e93dad5dd3453f20e4d6c116ecc034f7904ab1c81553c2176a06cca48ba5d5a33a04ff52f42aa113d7a0732d980c81dacdf8a210a3fdcc75	Santhosh..exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	Santhosh..exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2220	Santhosh..exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2220	2384	Santhosh..exe	29
PID 2384 wrote to memory of 2220	2384	Santhosh..exe	29
PID 2384 wrote to memory of 2220	2384	Santhosh..exe	29
PID 2384 wrote to memory of 2220	2384	Santhosh..exe	29

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\MyOld\File_History\[email protected]\LTP-310\Data\C\Users\Santhosh..exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\MyOld\File_History\[email protected]\LTP-310\Data\C\Users\Santhosh..exe"
1⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\MyOld\File_History\[email protected]\LTP-310\Data\C\Users\Santhosh..exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\MyOld\File_History\[email protected]\LTP-310\Data\C\Users\Santhosh..exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\MyOld\File_History\[email protected]\LTP-310\Data\C\Users\Santhosh..exe
  "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\MyOld\File_History\[email protected]\LTP-310\Data\C\Users\Santhosh..exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
6934e5467bf3918fbde4ab118b68db6a

SHA1
f32df48c759cec2dcf87c5d18f3f106ada15e915

SHA256
356ea8c373a69f75d8dfd2a2e143fa1cd68127570581b679282f0131234cf78c

SHA512
f1cba7b3031b341d91118c73f64d6fd6d5d6e907bf18ddb94b5842079f6ed13dd79609fb38a73d8943bd1cda5a75a5189fa00276d5055978ab4c409b8fed9b90

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
2444fa767c655007c1e496769bacfc02

SHA1
bc009047db77b8f7e7631cf517e30066e1920a03

SHA256
06efa7808b0d4af22066e0a8fc1eb2030f037d872863276ed5cd856836bf39e9

SHA512
5c13ce068da7fccbdfe6acd7d4a7a7d5283f2625f6ab6bb3b834f88e1ed03b72e5960af46ecf8212940ce0bad440780906cd48f9b12ef6e448f16f95999200bb

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit