flawedammyy | e4a87095c27219afe9c7a3cb01c13de899e201d2340748a5fc446207c8f99b2a

General

Target

aa.exe
Size

651KB
MD5

b730e7b8f3eebd51dc21d7997313b890
SHA1

57ef7a2d07f3703f84c1d7ad33e34e550d23a6fa
SHA256

e4a87095c27219afe9c7a3cb01c13de899e201d2340748a5fc446207c8f99b2a
SHA512

05e87e0ac0e6c097cec3e3801c66752f1a69bd3f8b732062b16596fd4e46388e66eb2e4455ede69769dad62cb7a063849cc2199c140c6ba6a498173eaafe051d
SSDEEP

12288:caA9OKLSwaIN5U8xvFoRQMEoO2rx8ikfRtjIe9rtv8zl6mi/gQ:AkK+waI8JRQMEJ2rufRtse9rtv8zlBi3

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

aa.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation aa.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	aa.exe

Drops file in System32 directory 14 IoCs

Processes:

aa.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\53FCEBB704C2EA83AF86768E62376EB5	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\53FCEBB704C2EA83AF86768E62376EB5	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	aa.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	aa.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

aa.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	aa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	aa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	aa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	aa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	aa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	aa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	aa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	aa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	aa.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

Processes:

aa.exe

description	pid	process
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe
Token: SeBackupPrivilege	428	aa.exe
Token: SeRestorePrivilege	428	aa.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

aa.exe

pid process

428 aa.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

aa.exe

pid process

428 aa.exe

pid	process
428	aa.exe

pid	process
428	aa.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aa.exe

description	pid	process	target process
PID 3212 wrote to memory of 428	3212	aa.exe	aa.exe
PID 3212 wrote to memory of 428	3212	aa.exe	aa.exe
PID 3212 wrote to memory of 428	3212	aa.exe	aa.exe

C:\Users\Admin\AppData\Local\Temp\aa.exe
"C:\Users\Admin\AppData\Local\Temp\aa.exe"
1⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\aa.exe
"C:\Users\Admin\AppData\Local\Temp\aa.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:3212

C:\Users\Admin\AppData\Local\Temp\aa.exe
"C:\Users\Admin\AppData\Local\Temp\aa.exe"
2⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\settings.bin

Filesize
76B

MD5
090bba5cbe9cd62189310f633f14d686

SHA1
0ce1d78aace04650b0c592665686a89412c1771c

SHA256
7bc48188bbd0ad1b7ac10257e6a8fc5327f2ccfd56402a4353f6d8ef26eb0ff8

SHA512
846781bdb4d8902963f1859077c8db4c763fdd4ca28f0be83b95c20d324b5db030f312fc3d4f959dc05ca4f41ef872a49d123195494b16440e16ebcc5edb31a7

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads