flawedammyy | badb2ce8b876d8b90da34d371a84f74bf4beec4ce074182901dc007b63ee91db

General

Target

MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840.zip
Size

380KB
MD5

996e0af813a92a438defebcb18e8a593
SHA1

45fc98787f077cc8ac8191e411995355b9e55375
SHA256

badb2ce8b876d8b90da34d371a84f74bf4beec4ce074182901dc007b63ee91db
SHA512

a56100178ed47af8bb790854ec182d569a23e0eb52f16f958677def91a8c5a2da4d69ca31f522aa7f7ec38c8cd1c37f1e74d8456bc29c6b01bd7229acef8e2c2
SSDEEP

6144:XKxEKAKTSiq645ecqcqCQP/J5NhyI9QPqlc7j+rOvXC59kKBwmcGm6OEGnSSFPAl:XK+W3q645eWVQPbX9QPqlc7j+WI9XBwE

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

Processes:

AA_v3.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

AA_v3.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d56736608796d5b5b4e1552532cea8c583a2fb26b	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 78c29dc41280e330457f346efb88c96208b6c87d99a606eb0865d6fca1c742f79da2d70ab1759121ba07e17c0e83d927921cac93bc1df69f3d412dc5155dbfd9cde809a9	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AA_v3.exe

Modifies registry class 1 IoCs

Processes:

OpenWith.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings OpenWith.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

1840 OpenWith.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

AA_v3.exe

pid process

4980 AA_v3.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

AA_v3.exe

pid process

4980 AA_v3.exe
4980 AA_v3.exe
4980 AA_v3.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

AA_v3.exe

pid process

4980 AA_v3.exe
4980 AA_v3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	OpenWith.exe

pid	process
4980	AA_v3.exe

pid	process
4980	AA_v3.exe
4980	AA_v3.exe
4980	AA_v3.exe

pid	process
4980	AA_v3.exe
4980	AA_v3.exe

Suspicious use of SetWindowsHookEx 23 IoCs

Processes:

OpenWith.exe

pid	process
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe
1840	OpenWith.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

OpenWith.exeAA_v3.exe

description	pid	process	target process
PID 1840 wrote to memory of 500	1840	OpenWith.exe	NOTEPAD.EXE
PID 1840 wrote to memory of 500	1840	OpenWith.exe	NOTEPAD.EXE
PID 752 wrote to memory of 4980	752	AA_v3.exe	AA_v3.exe
PID 752 wrote to memory of 4980	752	AA_v3.exe	AA_v3.exe
PID 752 wrote to memory of 4980	752	AA_v3.exe	AA_v3.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840.zip
1⤵
PID:1092

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AmmyyAdmin' in file 'AA_v3.exe', during attempted open
2⤵
PID:500

C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.exe
"C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.exe"
1⤵
PID:1836

C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.exe
"C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.exe
"C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.exe"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4980

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.log
1⤵
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
79f30ff5de3802b475e3131b70e0c506

SHA1
9f00b666ae729807b988a46101d2dc2b3c38a50e

SHA256
c5716fcdd7ab456192c7ac8cd29de8945634b6e062782ca7c90601b610dd9fe7

SHA512
2a5cb9ff0057b4a14316bd89a2d855ae9db8ad8540fc94ee0347192284570f13b72d61d6d465c8aacbd0e110eb6d9b0404cedcc18867f4359cf82ff8cc2eb2a9

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
d435919e40e9fdfb2dc173e7f33a2cfd

SHA1
26e0771c04ed962441dce7cf1597dad31fe8d777

SHA256
9a4e438a4e885a34e24ee93a97d83aa52ddaef746080b4add5d14b878191a246

SHA512
9f0a103ccf6a61cd260ae6e1b06e53726dcd8a94704f30c83e65fe9c758d7f44d290a44373c68d163188576e4d12364430f9bc9419491f92ae7bbaa27a26fc32

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
270B

MD5
6910d9160b66c4395f587a279e80f132

SHA1
54949c04c8c0970aa5e2d3fb2912318daab97b98

SHA256
72d44ac6019d486fc1a58334ff8ed692de0a9ed96de3142638c71376ceade87c

SHA512
82967a8bdbad58f2a81d063c84294153dbdd86322d4b6e3631122530dc7f00fd209ed1d2b0683eb60f726fd3d6f93c7615bd1d0d1fa1f5441119d0e5007582b9

Download Submit
C:\Users\Admin\Desktop\MDE_File_Sample_2e5265f35f75a50c89e592e127bc80e1e45aa840\Defender detected 'PUA_Win32\AA_v3.log

Filesize
184B

MD5
3e6fc9a49b8f370543db8faba0567e23

SHA1
7926f44fa6f7446fdeea60d3160b80ca42e8d1ef

SHA256
4055712b16b3b9bb30d4d00af4127e83ef6d3f6e2594f5e7736982c364308f32

SHA512
4b9be346b845c6c7e47f56df689d129b7e05fb6618e68efd8e261c21bbbcc3cfbf1633e75029068a0bde6d9dda8e5f67ac282859de1d017fefeb7045b73ffa09

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads