ammyyadmin | 34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5

General

Target

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Size

322KB
MD5

fcc84b2913606db9ed575affe65591ae
SHA1

a6b6c3e28d245df70c307c354eab877e5fb8efd2
SHA256

34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5
SHA512

5e6f9b0040acea1dce8463bd30eb7905de215fd378d112a4d50dd80303539c38e1f516b7512297c215ae77050445785f994a96b7c8ea94a075ea340229b7e0c7
SSDEEP

6144:MtU6T/wE1MFGonDrJU2kY1b94hsmjVTPdgBGE7YpqTFIVo+AxU36WDbl3:aU+/wEKAonDrFyhtTR+YQTL+Axg

Score

10^/10

ammyyadmin flawedammyy rat trojan upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2260-6-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral2/memory/4688-4-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral2/memory/3660-11-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2260-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/2260-6-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/4688-4-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/3660-11-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

Modifies data under HKEY_USERS 6 IoCs

Processes:

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c69585c4014525357a96b7a57ccb26b	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = a3b8da58ba6d715109b739e9e5493522349e59ea604c4e7db7ba83aa5481dbf4e5806813af42428727bc476fafa88e12474370948a678c399a10159cf8ed95702ca4231b	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

pid process

3660 fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

pid process

3660 fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

pid	process
3660	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

pid	process
3660	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

description	pid	process	target process
PID 4688 wrote to memory of 3660	4688	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
PID 4688 wrote to memory of 3660	4688	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
PID 4688 wrote to memory of 3660	4688	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe	fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe"
1⤵
PID:2260

C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fcc84b2913606db9ed575affe65591ae_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
70b12ea9d08c49e62f2eb6bc8136302c

SHA1
8db6ec47f70a2186a70df287a4f3472e28ffe900

SHA256
2a1cade014fdf7be79a3038587529f2d863da2f69c1c475fef4751fcec3700bd

SHA512
206e15dfd2f45ddf0cf0d598de61a5142bf19cc58bab49316e589155ca3aa4a93e7a64b566d3d788cf22191344d43fea0056ab16be4c83ac32a187e9bf3e9b7b

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
414ec5236d4c50ec2341edd15de683c6

SHA1
0e6b9aa7344ff052aadae62f26e661ead2383975

SHA256
a63ea63da3dbff563e5c6facf4ea870e09646b10d808eaa388e1bff70b7bc557

SHA512
fcf6f3202a533412fba6f6b2429fe1555f17fdbdee54c8f70aa0e351a448d8a9b900bb798dc297755f51cd98aa5190797c571c84d9170526e2f175859baed9ea

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/2260-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2260-6-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3660-11-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4688-4-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads