flawedammyy | c1bfd7bae65c6f46a8d512dd23a522d495e9a58a91d43bd1b43251e935a5acd3

Analysis

max time kernel
160s
max time network
188s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Panel/Panel/builder/AA_v3.6.exe
Size

762KB
MD5

e9b569f7cbf23d91df065c18f4c43840
SHA1

5d7cb1a2ca7db04edf23dd3ed41125c8c867b0ad
SHA256

d67c7ef1c8e2cd56e266902bef814ac328d64bbe06086f4ee24fbadbebf39605
SHA512

a9f01663b0c0ce9d30bd6760847bf3c18318801634145ec75e047019a8e8a9b13ea8122449b8f45ad40b63d4551cb85230df1b41a41ddc33a39cfcf2ec237ccb
SSDEEP

12288:kX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VEoge:2P++ZSlpOUC1KT4+URtYshX5aRlQEYte

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Control Panel\International\Geo\Nation	AA_v3.6.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	AA_v3.6.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 6117ebccd4efdacdccbadacd17576c2fe288fe898e5768e0c222ddface87c958704f14e3572385b191a1bee575f0b1e0db9eafa8d5ab354fb06a60fce80d02f23e59d0dc	AA_v3.6.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	AA_v3.6.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	AA_v3.6.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2760	AA_v3.6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2760	2664	AA_v3.6.exe	30
PID 2664 wrote to memory of 2760	2664	AA_v3.6.exe	30
PID 2664 wrote to memory of 2760	2664	AA_v3.6.exe	30
PID 2664 wrote to memory of 2760	2664	AA_v3.6.exe	30

C:\Users\Admin\AppData\Local\Temp\Panel\Panel\builder\AA_v3.6.exe
"C:\Users\Admin\AppData\Local\Temp\Panel\Panel\builder\AA_v3.6.exe"
1⤵
PID:3068

C:\Users\Admin\AppData\Local\Temp\Panel\Panel\builder\AA_v3.6.exe
"C:\Users\Admin\AppData\Local\Temp\Panel\Panel\builder\AA_v3.6.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\Panel\Panel\builder\AA_v3.6.exe
  "C:\Users\Admin\AppData\Local\Temp\Panel\Panel\builder\AA_v3.6.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\settings3.bin

Filesize
274B

MD5
bcc40b676c5b0f5a176be92cc8f4199f

SHA1
5415364e6ab90151eb1272268cb75ef6c4306a2f

SHA256
d3df407118bd28d28e7d3c8afc497c5e478e5d078f7792501ddecb45f3b51826

SHA512
467c473be5b9f6e0b8302620b6fbd9ad84f90da2bae3247d8326a22bfdd902fd79e55a2160493903eb747db6ef38fc9decb3db372afa26667f374ca2d0ceb36d

Download Submit