Malware Analysis Report

2024-10-16 05:12

Sample ID 231031-rg3nvahf31
Target 6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe.zip
SHA256 6ada743ecb0767e2d93b199230888409b87999e8867e24ad7a9d616b07a2ed69
Tags
ammyyadmin flawedammyy trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6ada743ecb0767e2d93b199230888409b87999e8867e24ad7a9d616b07a2ed69

Threat Level: Known bad

The file 6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe.zip was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy trojan

Ammyyadmin family

AmmyyAdmin payload

FlawedAmmyy RAT

Loads dropped DLL

Checks computer location settings

Drops file in System32 directory

Modifies system certificate store

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-31 14:10

Signatures

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Ammyyadmin family

ammyyadmin

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-31 14:10

Reported

2023-10-31 14:45

Platform

win7-20231020-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe"

Signatures

FlawedAmmyy RAT

trojan flawedammyy

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5E C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5E C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0067000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA793CFD-895D-453A-AD63-7E96196E1D4B} C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 4f01406bc4b9988ab4c2d7ea9dbd544715b8f837caa1c5a4fd97c02186e3369fa326d843a4075577f2abfd204f6aae54721475f0e8136e3c1d6eee27252ab90adb15f675 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA793CFD-895D-453A-AD63-7E96196E1D4B}\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA793CFD-895D-453A-AD63-7E96196E1D4B}\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-f7-14-b8-c0-27 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA793CFD-895D-453A-AD63-7E96196E1D4B}\WpadDecisionTime = b0b996d7080cda01 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-f7-14-b8-c0-27\WpadDecision = "0" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-f7-14-b8-c0-27\WpadDecisionReason = "1" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA793CFD-895D-453A-AD63-7E96196E1D4B}\WpadNetworkName = "Network 2" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-f7-14-b8-c0-27\WpadDecisionTime = b0b996d7080cda01 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DA793CFD-895D-453A-AD63-7E96196E1D4B}\ca-f7-14-b8-c0-27 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2128 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe
PID 2128 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe
PID 2128 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe
PID 2128 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe
PID 2972 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Windows\system32\rundll32.exe
PID 2972 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Windows\system32\rundll32.exe
PID 2972 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Windows\system32\rundll32.exe
PID 2972 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe C:\Windows\system32\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe"

C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe"

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.242:443 tcp
US 8.8.8.8:53 www.ammyy.com udp
DE 136.243.18.118:80 www.ammyy.com tcp
DE 136.243.18.118:443 www.ammyy.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.153:80 apps.identrust.com tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 ac7221c691ef0a93dbbb5bee6efcb7ec
SHA1 54f197fef16badefb4bf0d7339f6bd1099e505da
SHA256 b6b033b71d3f7f92986e32a61b3244b9856e82a9c3d233696a0dfa29a517106f
SHA512 226299ab1b7b388473163f4fecc41d536755586b4c275475128c5e5946554cd9ca69df223469130d85516f2ac2330a2cb35dec2879355ea0186b63d8429dcd6b

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Windows\Temp\Tar92A.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 57d8bd99e9beb16237a9a89fc78300dd
SHA1 9751acb823124a347f57ed52b6c8b0d301312996
SHA256 864a3be6af43b8e505f053151b9a1f1e4aca9c71f36c77e717bb1facfa52ff36
SHA512 d39b104ce0c431d3d89758f3fe4049c36a7661dc2549b59e5bda0d1aa5c206aa49ca37152f1a6999a6b823e166e401e3719e0516326563f411a1bc6ebb65e4ab

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f61062ac645252ce686e74e23084dd8
SHA1 30487a85133230f35cab5634c092a1f9fa682e51
SHA256 c6e72eb0b49e3bc8c1aa4d4fc766138c90e7fd10d672dbdb6ad3616aad053f37
SHA512 ddabf9e182e4f15d1cf41723bb35515e915e7fa498a61b4130a63a2bf94e7719b4b41640902c35f26ce2964f4162e6b3db4a9f7f2771005c44ae28beb2427b5e

C:\ProgramData\AMMYY\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\ProgramData\AMMYY\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\ProgramData\AMMYY\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\ProgramData\AMMYY\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

\ProgramData\AMMYY\aa_nts.dll

MD5 480a66902e6e7cdafaa6711e8697ff8c
SHA1 6ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA256 7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA512 7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

C:\ProgramData\AMMYY\aa_nts.msg

MD5 b1d22f734830054cf3da67b7ff3f84d6
SHA1 c3e21f75f2d7359d096a11de7b863e6cc3cf6808
SHA256 51909f0bcf49a68e1d041c72af208328a3352ffa531a09902f010a023466e82f
SHA512 3f59d8955bab67f1ad901e2c90f4a14bc039cc704a34e2b1f81f0c4e3f7ffd31a71a5c1fbb8f40d37c5822f59b999631368abe2a3da685686e36128a2b8b51c2

memory/1092-119-0x0000000064200000-0x00000000642EE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-31 14:10

Reported

2023-10-31 14:44

Platform

win10v2004-20231025-en

Max time kernel

142s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe"

C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe

"C:\Users\Admin\AppData\Local\Temp\6f15160778efbf7ea7ae3d232d90cc8a1773841745e4bf370df3860570bb49f9.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
NL 8.238.22.254:80 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 254.7.248.8.in-addr.arpa udp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 ac7221c691ef0a93dbbb5bee6efcb7ec
SHA1 54f197fef16badefb4bf0d7339f6bd1099e505da
SHA256 b6b033b71d3f7f92986e32a61b3244b9856e82a9c3d233696a0dfa29a517106f
SHA512 226299ab1b7b388473163f4fecc41d536755586b4c275475128c5e5946554cd9ca69df223469130d85516f2ac2330a2cb35dec2879355ea0186b63d8429dcd6b