flawedammyy | 80d99ecd3257ffbea3f4eab3ad67a0925670700896a6e8fec5e334f67398e1f3

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 04:33

Target

7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Size

756KB
MD5

7f80b6c61c6849a43f28cafd75b4f8a6
SHA1

bddb2615c0d77763d6b67a4518646d40afb46fda
SHA256

80d99ecd3257ffbea3f4eab3ad67a0925670700896a6e8fec5e334f67398e1f3
SHA512

4b8594b6a3597dc9c10cbe873d022f2b6b0b67e28be92f9479f07fb3f643c7286d414a3f0b611daab4cc50a91e18e34263f5007400ba31e921f1d1926bb0181e
SSDEEP

12288:cX5PFc+E0SlpOvcC1KL/q/IZVURtCdshX5x8jR31QEY0VE+gP:+P++ZSlpOUC1KT4+URtYshX5aRlQEYrP

Score

10^/10

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

Processes:

7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 5ab7fff5aff6377fad8f4dcc8e2371bc56e9168ad3b2836685f84931979646e0b9d10b418fa16b391bf023f72bf4a928739cc4d117923e83f9502f16951a23f8afd142a3	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

pid process

3868 7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

pid process

3868 7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

pid	process
3868	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

pid	process
3868	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

description	pid	process	target process
PID 3664 wrote to memory of 3868	3664	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
PID 3664 wrote to memory of 3868	3664	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
PID 3664 wrote to memory of 3868	3664	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe	7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe"
1⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\7f80b6c61c6849a43f28cafd75b4f8a6_JaffaCakes118.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3868

C:\ProgramData\AMMYY\settings3.bin

Filesize
358B

MD5
7f8803567514be9f7adedd51a77c414d

SHA1
6fddccda062b8553e15845e72ad62e79ced9905b

SHA256
bbd09f97009a10db7814c309a10a7737d0d9ccd182ba5dc86e18e473f222b3b8

SHA512
966a4f56263959f63bb4ef30c9d1f506251f9c7bfd3fa3a0c98f28ea872add81b118a9aecb433e3d72eb24dae09aea4e656d46324577a94e25122d5cc3d774ee

Download Submit