flawedammyy | d37a1406fe50b4b4a832ddeb77d631d613b127c24535afd876b836f6ed4bd464

Analysis

max time kernel
77s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Size

713KB
MD5

c59be0a84718d97a82cfa59860bdab3a
SHA1

2a0df9bf173e167f90331d4ba4b05720ba6d37e4
SHA256

924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54
SHA512

245e9b6d513ca17ba8561e40b3c3a5cccc5b2256358fbf30383a72050f0c817d2272284a92a8b22f75908f86474f6367beb16ebc143c9b96ad64d7e5bff3862b
SSDEEP

12288:dVr29UGEg6VUM5oAL1jq3E2jj0NOjAqHKtCessZWjya7VM1en9Nm1RtNeCVao2Vp:vUbj4qwCessA41Rt0CVMVZtxP

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Control Panel\International\Geo\Nation	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c105953e7f7125ec364b26b	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 90d11307dcc3a0be917a0f4b9e97706ae62fe39302e7fa1496f9d89280ef294b7dd376b68d8ba77c9c62b514710f894678f223c0066acc8b2d2e722d36dafa73c7c9e0e1	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2244	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2244	2408	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	17
PID 2408 wrote to memory of 2244	2408	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	17
PID 2408 wrote to memory of 2244	2408	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	17
PID 2408 wrote to memory of 2244	2408	924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe	17

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"
1⤵
PID:1268

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe"
1⤵
- Checks computer location settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2244

C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe
"C:\Users\Admin\AppData\Local\Temp\924314d642591e2c6fcfee28a0d69ec1621643c13a5ab1c5cbef973b8b57fb54.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
dca63575c99afaf91beb4b1e26ed7398

SHA1
61ed0ddaef55bffff46ecc5d4027f2285f6ddc94

SHA256
42db565934d1119666ae283c8f6271088af9f63aa5384fcac6de51d6a78f5a49

SHA512
f4174258f38cc0a19fc2a1153dde7eba0980e70235423bcadb200dfc7b6cf27cf59b381a9d5a24183c3b77b3e38f0d7b2d654bc4da3d886ea121baaaa7c09ac6

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
3e898032092d931eb6626ab01a08d835

SHA1
ed864bef5ab61485adaafee0c24c6a8d4b2e244b

SHA256
75b1d9b668d5dae5afaf0570809b0115818685b573005bb9b05b4983cf4dadd5

SHA512
84302130293e4fbc900c2cef9b113c050d7718de843a8b6b10fbe087c86cd54c626efe26ce80f4c9c23017a2c9123e02317199a3a82a89c77fb731cf2023a93f

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit