flawedammyy | 553d2f7a372c37f11870bcfc9cd923037b45ac97a130697064549f48e81ac29e

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12-05-2024 14:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
Size

735KB
MD5

3aafebbf1591363029b868c1b664b808
SHA1

7f213071dd178ec31afe1c8a443f817fce50b233
SHA256

553d2f7a372c37f11870bcfc9cd923037b45ac97a130697064549f48e81ac29e
SHA512

8fcd5bacbdc5aed3c48420fcbd3ea5a4a8a0a5c81ab043addbd8b2e559f8a9580b6bbdd513273d6075f69f04f52f6d413941095895c9a06677e61e0ab201b596
SSDEEP

12288:7c0dZib4t9uOroAgUHvCUt4RtlTc+YNKpQsNvVd6gr:7c/UtwOrZgUHv54Rt6+YNkQsNnr

Score

10^/10

flawedammyy trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d56736608796e5f5e4c1059537739d76834fbb26b	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = bb01cab9c77df123f0bfcad0a7171ff1b7119ad70571d181f9f5c88a12bcc6f5f2b0ef7e7e830ae30b106590ca2c46c8da5b462136edd07fe016030827b8daf1b2c2839b	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2504	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2504	3024	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2504	3024	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2504	3024	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2504	3024	3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe"
1⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3aafebbf1591363029b868c1b664b808_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
167a2ca0c95f830340baf3683ff153b8

SHA1
33dd267729247e10460821fd75af2e4ab0bdc1a0

SHA256
3c3ee622daccde7bc459ee25006d0bc343495a1fc6c0fa94f0c148d63ec51d2c

SHA512
584508e5e057babbdc7cdaaef547c4c7a9c7002946abd40440d40a3efa51cfefb6bc0cedeeae51a8c9f7bd0996bc6331cfd97c3ae7db3cadf78154749f9830b4

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
f4fe3ae1d040f050663766afe2d4abe7

SHA1
ba30a9a9505a7807fa70a145f3a552f4886045d1

SHA256
e6a19d8b9ea88947d375a3d55a8c6f0e5dbd21d669c5064d2c148b9543c439b2

SHA512
8510aff39991dada237fba65bb4006cf69ed6cbc70a6e4bf33943c781fb6951a8f6606f0bf3af6210d822ac7f77358dd34d748932f6c3c7a465240be32328310

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit