ammyyadmin | 432b8efe51e51b684307ef832bde5a3620aefad51d5ec33a561a5eb3cf5569c5

Analysis

max time kernel
150s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Size

705KB
MD5

644458de4a05f93d6d55e5e896926036
SHA1

0cd0d998db4fe3f37458ac69aeb0e19783d3166d
SHA256

432b8efe51e51b684307ef832bde5a3620aefad51d5ec33a561a5eb3cf5569c5
SHA512

4d1014c13538b2d05788e4c50421790e3c5e0d2c3a43262145c45b83e74f4e8fecdcfc050ad6ae06a1a762df5f267d654a1b8990676291327cfcfafee9b656f9
SSDEEP

12288:Rhjun1eaHjs7C8la0n9lp9Dkb1RtgA93ykM+TZtC3lgk:vqeOs7C840n9lpG1Rtb93IKZtfk

Score

10^/10

ammyyadmin flawedammyy rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 3 IoCs

resource	yara_rule
behavioral2/memory/3600-0-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin
behavioral2/memory/1864-5-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin
behavioral2/memory/3600-6-0x0000000000400000-0x00000000004C7000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c69585c401452534e914f012c83b26b	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 6666afe739a7c74303a8e497736d84390dca6b082443a1ed30a1038238b3376585258a6c336c2562b92625ca8d9e6b20f9a859fc7ee7d26eca3008c2c3a37e50186472af	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1080	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1080	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1080	1864	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	86
PID 1864 wrote to memory of 1080	1864	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	86
PID 1864 wrote to memory of 1080	1864	644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe	86

C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe"
1⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe" -service -lunch
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\644458de4a05f93d6d55e5e896926036_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
5109aaa4dcdd5a9d2754b9e087e048b9

SHA1
b1d906d0ffe0ca59dd72c77989d4d08bd43b285b

SHA256
adb248b41aec101a648848a37c6a72f6761ddc6a28bb1e4c008849401248ecaa

SHA512
03fa52ee07b0252771f5520cbe746d1519ad19dd42c8581a84cc8dbc07a56055b24bd23f6e33b318327fec0a858424c6b45f53cb58bb95e6522af3e0e7e7d7d5

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
68B

MD5
a4bf5423f102eac5dd4058ca65177313

SHA1
a97a396a303d9fa3884e6fe10ee0f3f00290dd2c

SHA256
815bdc9f0c5f4fdd4582d53d230808fddfab52cae26de11ce8692ace6faef1b1

SHA512
170644df552e4c7fe0ee97962253f0c1b2450caef31402d612992957920a88a267c1e7dbcbefe0fe6b3ca97eb4f085afd53d9264c42674eefc3a107f99ffad28

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/1864-5-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/3600-0-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/3600-6-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download