ammyyadmin | 34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5

General

Target

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Size

322KB
MD5

fcc84b2913606db9ed575affe65591ae
SHA1

a6b6c3e28d245df70c307c354eab877e5fb8efd2
SHA256

34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5
SHA512

5e6f9b0040acea1dce8463bd30eb7905de215fd378d112a4d50dd80303539c38e1f516b7512297c215ae77050445785f994a96b7c8ea94a075ea340229b7e0c7
SSDEEP

6144:MtU6T/wE1MFGonDrJU2kY1b94hsmjVTPdgBGE7YpqTFIVo+AxU36WDbl3:aU+/wEKAonDrFyhtTR+YQTL+Axg

Score

10^/10

ammyyadmin flawedammyy rat trojan upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral1/memory/2076-9-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral1/memory/1748-8-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral1/memory/2916-6-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral1/memory/1748-15-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Control Panel\International\Geo\Nation	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2076-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2916-4-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2076-9-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/1748-8-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2916-6-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/1748-15-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = a36065b07dc55a5b2246d8833d8061929fe8064c314f19655f7dd7737c23b9bc0cbad6168ac7356ee7123bdf36f588d489428c5b380f99fb975935aafdfe5c6eb8761d7f	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c1059535760c57a57ccb26b	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1748	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1748	2916	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	29
PID 2916 wrote to memory of 1748	2916	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	29
PID 2916 wrote to memory of 1748	2916	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	29
PID 2916 wrote to memory of 1748	2916	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe"
1⤵
PID:2076

C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
a36990a022d0bc10369bd264b2904717

SHA1
67a1ec20d3a1c77303be14d4cab4f3b5a4e0843b

SHA256
287743202c652f03133a8374b0c72c89fa565a0e05aa4630dce644e453902427

SHA512
2578f8f1262ba2b6bfca3a13d162bde5e04c20e131bd54eacb4f0f766737688bc767cd4e46fce6e6cd04a41a7677d9dc5c0e2e20f1655648ac0a04bf1b3180f6

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
d989545cddd43e438c2d259eee3ef69e

SHA1
a601bd2ccb70f332a1ec372db1bcc2da4a91c75d

SHA256
dc678860ed42d8a8d4bcd68769b3aea39811e6483ff8bca988ad2b2445892751

SHA512
753cedcca5b565a0c73abb4896656471c15edfd69a4c1d5513587c6cb362e6f08e045588d57c509174eb7ec51d68d4f07fadd7764678134c86afbf1309cf8641

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/1748-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1748-15-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2076-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2076-9-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2916-4-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2916-7-0x0000000000EF0000-0x0000000000FAE000-memory.dmp

Filesize
760KB

Download
memory/2916-6-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing