flawedammyy | 3727d712e619a7c1de57a4987614cc11f08cdcf9ddb6d798a52b30b7f3ddfdf4

Analysis

max time kernel
158s
max time network
161s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
Size

720KB
MD5

3d545a30c97699a5b44fd85b40d05016
SHA1

93432f2a5b5352cc94d3c4f196f60245f7efda6d
SHA256

f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3
SHA512

453fe53dd79d7bc478cad9c74e9f86c30f522faa0b28b27ad0782afda2193e465a5d0d326f9aad235c106065d44a4c9d1a43bc24414fce5ebb1e104c0df1c317
SSDEEP

12288:qzJUxbtiiTHRJuEkQO7EwC2ZwFRtAdRXRryd+sq1zngB:q9oNTHRz/O7rT6FRteRXR2IsqqB

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\International\Geo\Nation	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953579f169e4e53b26b	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = a3dd542fa70e2fce5ac79663b7a493a662260705b082e6c206d7b330082fe7d2d35104d1123ee40873c51a2448bfc541c261ca2c9b2e4269b8406cc41acfecc31d779d5e	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2424	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2424	2172	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe	28
PID 2172 wrote to memory of 2424	2172	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe	28
PID 2172 wrote to memory of 2424	2172	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe	28
PID 2172 wrote to memory of 2424	2172	f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe	28

C:\Users\Admin\AppData\Local\Temp\f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
"C:\Users\Admin\AppData\Local\Temp\f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe"
1⤵
PID:1068

C:\Users\Admin\AppData\Local\Temp\f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
"C:\Users\Admin\AppData\Local\Temp\f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe
  "C:\Users\Admin\AppData\Local\Temp\f9cc4a11a11e7c2aae54d608186614ed82155132f1a11f340e4179b7313f2bc3.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
2a8dbfca7e7fccf3dd7d995547a16fb1

SHA1
f5cd282770810038d8f97824f2df2f35492f506f

SHA256
1566ac51d19d95f227f2ec73f564d5a4f69ac8cfad3322af697c49cedd1f4432

SHA512
a1c6ffce16dd357351826728ffed4563fc1c595515b0f8662b0daa76435affa5143d9c437a6a382522b4bbc0f31c33a425a1145ac84dbf122597228f0faae9e2

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
4e6b28ba102a5fd80e6355bf966cd41a

SHA1
e4ee4d83f38a448eb5d42e9aa2710c7986a07e83

SHA256
b594678f11e2bccb3511848cb53ebafbfb55a009e72600186731e6e60a143930

SHA512
496be978fbb243dbeec765c9de4fdebe0bec81aa7b501a7865d984394d4ef48f433a495dcf5bff258b0f64488941d7c6652b157782f952d14aa670dc518f090b

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
307B

MD5
4b1262396ed78b0aee884df3c46b46f0

SHA1
1eca767c92e65da3f72fed57bf44be41906b62b0

SHA256
3b916abde3f50bdc3dc54191f6955f84889d922b2d27f52acc9c0a407817fa67

SHA512
62d368c439209db7fdba6336d88809ca7a3368e5e5f8da54ed1e2c4c93662ae5bde2935daebd8707b767c1fabaf29a5ba08b450a96225a8afaf19f5bc155f8eb

Download Submit