flawedammyy | a0f4da42bc836acaa6260abbe06c79808a169545344a90f0d3d15e113b70f0ed

Analysis

max time kernel
152s
max time network
163s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Size

746KB
MD5

f8cd52b70a11a1fb3f29c6f89ff971ec
SHA1

6a0c46818a6a10c2c5a98a0cce65fbaf95caa344
SHA256

6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
SHA512

987b6b288a454b6198d4e7f94b7bba67cafe37f9654cd3cd72134a85958efd2125596ae48e66a8ee49ee3f4199dac7f136e1831f2bf4015f25d2980f0b866abe
SSDEEP

12288:PUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjcP6gX:zpJJWOwlaUPcWWwRZb4Rt+N5WMasHoX

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Control Panel\International\Geo\Nation	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 90379fcf296f97c8a0deacfec279eed67741dcd4885f9aa3e2729f8f5b48fccda72b63df3af810656baaf33e0650621060f5f125a1911be8d97ef367da66192563eec330	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953e791939b4f53b26b	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2184	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2184	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2184	1752	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe	29
PID 1752 wrote to memory of 2184	1752	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe	29
PID 1752 wrote to memory of 2184	1752	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe	29
PID 1752 wrote to memory of 2184	1752	6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe	29

C:\Users\Admin\AppData\Local\Temp\6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
"C:\Users\Admin\AppData\Local\Temp\6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe"
1⤵
PID:2228

C:\Users\Admin\AppData\Local\Temp\6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
"C:\Users\Admin\AppData\Local\Temp\6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Users\Admin\AppData\Local\Temp\6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe
  "C:\Users\Admin\AppData\Local\Temp\6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
c275dfb46daf99d7727e3d6a9a4736e3

SHA1
64126fbc1735d5d98ba45c0fab878087be25b76d

SHA256
fbb53f9645d1d6fef25b1304cae9d744c70986df8e79a8e7154b21c1ba0bdacf

SHA512
01c77022669f9b14c50919bff6431735fae69456adc558c997cb6c35f92004737cb3654d8009051b8be757cc721e76189ea37e81ff6754c111508a1e0d25d630

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
bdcf2bc255c9f505ffb4e2d1df7f30ee

SHA1
49914d7e481ab3c9313d96f9aed0b3e653f1df73

SHA256
471ac7ee18c7f9465bb1ab730a79de6ab8d8986724a0c1e7b4037202a5c39341

SHA512
21f1fd1389a5f0e3223cfac70104d3c74af68215859d4a06e7fd0b94f315f7668a81d8809cabe8a20a5d8b4dada7cec0e2ad6a8688435494bef21bcf795cece0

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit