ammyyadmin | b88f6c305d8066f04f98419a2705f82976e225b886d0d621ec9aa6fa33c6956f

General

Target

025754318db94857d12110b010fe457d_JaffaCakes118.exe
Size

885KB
MD5

025754318db94857d12110b010fe457d
SHA1

e195e19413b83b2621d69d1b92cabcc94b3ebdd7
SHA256

b88f6c305d8066f04f98419a2705f82976e225b886d0d621ec9aa6fa33c6956f
SHA512

f930249d408f339a45baa6e5f9ebf681026666ae6e840181a67854cb4a4239f2d2a6f500d8d43e9ad1009158397a96c37dbe300414b82972b4e3effb0698c9d3
SSDEEP

24576:SZTqYfOectmtS4Px1Rt4MmqZZtU6N+Q1384XmD:SZTqBe6m8yx57tH138xD

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 4 IoCs

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000400000-0x00000000004B9000-memory.dmp	family_ammyyadmin
behavioral2/memory/4208-27-0x0000000000400000-0x00000000004B9000-memory.dmp	family_ammyyadmin
behavioral2/memory/1948-30-0x0000000000400000-0x00000000004B9000-memory.dmp	family_ammyyadmin
behavioral2/memory/1964-35-0x0000000000400000-0x00000000004B9000-memory.dmp	family_ammyyadmin

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c000000023b41-2.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	025754318db94857d12110b010fe457d_JaffaCakes118.exe

Loads dropped DLL 6 IoCs

pid	Process
1948	025754318db94857d12110b010fe457d_JaffaCakes118.exe
1948	025754318db94857d12110b010fe457d_JaffaCakes118.exe
4208	025754318db94857d12110b010fe457d_JaffaCakes118.exe
4208	025754318db94857d12110b010fe457d_JaffaCakes118.exe
1964	025754318db94857d12110b010fe457d_JaffaCakes118.exe
1964	025754318db94857d12110b010fe457d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	025754318db94857d12110b010fe457d_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525367faf378114cb36b	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 34bbe8d3b54c02077342bcc109b8c69975951b6ce9b4640b2b989da4518edd7254f155ab5ef47926645087f0b896ad4a043e36e2b9625d0d318b74fd06b54243381af76ce7fc817923ed3a	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	025754318db94857d12110b010fe457d_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	025754318db94857d12110b010fe457d_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	025754318db94857d12110b010fe457d_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1964	025754318db94857d12110b010fe457d_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1948	025754318db94857d12110b010fe457d_JaffaCakes118.exe
4208	025754318db94857d12110b010fe457d_JaffaCakes118.exe
1964	025754318db94857d12110b010fe457d_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1964	4208	025754318db94857d12110b010fe457d_JaffaCakes118.exe	85
PID 4208 wrote to memory of 1964	4208	025754318db94857d12110b010fe457d_JaffaCakes118.exe	85
PID 4208 wrote to memory of 1964	4208	025754318db94857d12110b010fe457d_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1948

C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe" -service -lunch
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
155101a05a2cc76e4d2c746c5eac34ef

SHA1
5335f3fcd2e71f6135b4823752e13507c48c274a

SHA256
9aa30e5db30407fc32f26650c17e1804de2d29d4252edde0008bd27cd65b69c0

SHA512
b27641bfe7ed18b1ed8cb0d480b5c1e5ceb5dee4620c1c738e01db06295c6d48b8698ae420a42b490583278ee8166ea1d32a6e92520ea52169a28dc5945e9f5b

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
15198d1c17607cb906658627232b3586

SHA1
b9a2ffe3b6abfdfef32addb702d9c78270ada8db

SHA256
46b2c199720c2544201ab5dee0db5ac545892c38a5cad06662ba14122e5be162

SHA512
bfa95f2ad565fc266ad19360840c606ebf93fe759cc6f8abbd284d49e95320e6c13075059ea20e87ae23724f8cc0b1ae95db92dcd9d734260fe9bcaa841a4540

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\api9B07.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/1948-30-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1948-0-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1948-29-0x00000000022B0000-0x0000000002323000-memory.dmp

Filesize
460KB

Download
memory/1948-8-0x00000000022B0000-0x0000000002323000-memory.dmp

Filesize
460KB

Download
memory/1948-7-0x00000000022B0000-0x0000000002323000-memory.dmp

Filesize
460KB

Download
memory/1964-26-0x00000000020F0000-0x0000000002163000-memory.dmp

Filesize
460KB

Download
memory/1964-35-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/1964-36-0x00000000020F0000-0x0000000002163000-memory.dmp

Filesize
460KB

Download
memory/1964-49-0x00000000020F0000-0x0000000002163000-memory.dmp

Filesize
460KB

Download
memory/4208-18-0x0000000000DF0000-0x0000000000E63000-memory.dmp

Filesize
460KB

Download
memory/4208-17-0x0000000000DF0000-0x0000000000E63000-memory.dmp

Filesize
460KB

Download
memory/4208-27-0x0000000000400000-0x00000000004B9000-memory.dmp

Filesize
740KB

Download
memory/4208-25-0x0000000000DF0000-0x0000000000E63000-memory.dmp

Filesize
460KB

Download

Analysis

Sharing