Analysis Overview
SHA256
b88f6c305d8066f04f98419a2705f82976e225b886d0d621ec9aa6fa33c6956f
Threat Level: Known bad
The file 025754318db94857d12110b010fe457d_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Ammyyadmin family
FlawedAmmyy RAT
AmmyyAdmin payload
Ammyy Admin
Loads dropped DLL
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Unsigned PE
System Location Discovery: System Language Discovery
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-30 16:53
Signatures
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-30 16:53
Reported
2024-09-30 16:56
Platform
win7-20240903-en
Max time kernel
150s
Max time network
146s
Command Line
Signatures
Ammyy Admin
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
FlawedAmmyy RAT
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c17525317257079114cb36b | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 4f953a6d1729f07e01897713acaae0ebdc608742756342ab69ffafad28690fa1fe00474622881aca98c7119a2c0eda39bc6dfbe0c21868f971e06deecde224349bdad55364317ab52b5784 | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2820 wrote to memory of 2720 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
| PID 2820 wrote to memory of 2720 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
| PID 2820 wrote to memory of 2720 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
| PID 2820 wrote to memory of 2720 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp |
Files
memory/2340-0-0x0000000000400000-0x00000000004B9000-memory.dmp
\Users\Admin\AppData\Local\Temp\yll6EF9.tmp
| MD5 | 685f1cbd4af30a1d0c25f252d399a666 |
| SHA1 | 6a1b978f5e6150b88c8634146f1406ed97d2f134 |
| SHA256 | 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4 |
| SHA512 | 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9 |
memory/2340-4-0x00000000005A0000-0x0000000000613000-memory.dmp
memory/2820-11-0x0000000000300000-0x0000000000373000-memory.dmp
memory/2820-12-0x0000000001320000-0x00000000013D9000-memory.dmp
memory/2820-15-0x0000000000300000-0x0000000000373000-memory.dmp
memory/2820-14-0x0000000000400000-0x00000000004B9000-memory.dmp
memory/2340-19-0x00000000005A0000-0x0000000000613000-memory.dmp
memory/2340-18-0x0000000000400000-0x00000000004B9000-memory.dmp
C:\ProgramData\AMMYY\settings3.bin
| MD5 | 097a18ed7b31114c7ef39ef06eff02f0 |
| SHA1 | 276bb5fc8ab72ed3a447dd57be668ace8f75a7c1 |
| SHA256 | 985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812 |
| SHA512 | 168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96 |
memory/2720-22-0x00000000007B0000-0x0000000000823000-memory.dmp
C:\ProgramData\AMMYY\hr
| MD5 | f258b93a7438ddf48d1cc25fba99d44e |
| SHA1 | de29637462d7f2325f2c96cc9cdb3efe440923d9 |
| SHA256 | 783b30f0cb4f33335a3206268e0a181caa5ef8c8fb0381bf9b2943450fdc4487 |
| SHA512 | e7a61aa9cba059d3c1c48c1b5523c008cc5b00e7e370a0b05196eaf70ad364ef468c837c45cc06f5dadd67663204e1dddc2a17f1fe525e4f4e820ec8d5cd79ce |
C:\ProgramData\AMMYY\hr3
| MD5 | 3b7c43598bbc8bc27863266c82c6e224 |
| SHA1 | f00e8d30f16000ba80768d29654baeb9143e0865 |
| SHA256 | b25edba7aa378ecd77d5870761302fdc0dd291bf9ee86eedd5dc0d8b0afc8e49 |
| SHA512 | a530cec0942fabb6b9bec90b9dafd0a30130d76ef09f48b3ea3cd7d54c4aba2a9a991e8a0ead2bf8360f215fbeed8f4981cb80d547e8a403c9901f271af1bfe4 |
memory/2720-29-0x0000000000400000-0x00000000004B9000-memory.dmp
memory/2720-30-0x00000000007B0000-0x0000000000823000-memory.dmp
memory/2720-36-0x00000000007B0000-0x0000000000823000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-30 16:53
Reported
2024-09-30 16:56
Platform
win10v2004-20240910-en
Max time kernel
150s
Max time network
149s
Command Line
Signatures
Ammyy Admin
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
FlawedAmmyy RAT
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Loads dropped DLL
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525367faf378114cb36b | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 34bbe8d3b54c02077342bcc109b8c69975951b6ce9b4640b2b989da4518edd7254f155ab5ef47926645087f0b896ad4a043e36e2b9625d0d318b74fd06b54243381af76ce7fc817923ed3a | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4208 wrote to memory of 1964 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
| PID 4208 wrote to memory of 1964 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
| PID 4208 wrote to memory of 1964 | N/A | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\025754318db94857d12110b010fe457d_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp | |
| US | 8.8.8.8:53 | 148.129.42.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 235.104.243.136.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
memory/1948-0-0x0000000000400000-0x00000000004B9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\api9B07.tmp
| MD5 | 685f1cbd4af30a1d0c25f252d399a666 |
| SHA1 | 6a1b978f5e6150b88c8634146f1406ed97d2f134 |
| SHA256 | 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4 |
| SHA512 | 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9 |
memory/1948-7-0x00000000022B0000-0x0000000002323000-memory.dmp
memory/1948-8-0x00000000022B0000-0x0000000002323000-memory.dmp
memory/4208-17-0x0000000000DF0000-0x0000000000E63000-memory.dmp
memory/4208-18-0x0000000000DF0000-0x0000000000E63000-memory.dmp
C:\ProgramData\AMMYY\settings3.bin
| MD5 | 097a18ed7b31114c7ef39ef06eff02f0 |
| SHA1 | 276bb5fc8ab72ed3a447dd57be668ace8f75a7c1 |
| SHA256 | 985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812 |
| SHA512 | 168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96 |
memory/4208-27-0x0000000000400000-0x00000000004B9000-memory.dmp
memory/1948-30-0x0000000000400000-0x00000000004B9000-memory.dmp
memory/4208-25-0x0000000000DF0000-0x0000000000E63000-memory.dmp
memory/1948-29-0x00000000022B0000-0x0000000002323000-memory.dmp
memory/1964-26-0x00000000020F0000-0x0000000002163000-memory.dmp
C:\ProgramData\AMMYY\hr
| MD5 | 155101a05a2cc76e4d2c746c5eac34ef |
| SHA1 | 5335f3fcd2e71f6135b4823752e13507c48c274a |
| SHA256 | 9aa30e5db30407fc32f26650c17e1804de2d29d4252edde0008bd27cd65b69c0 |
| SHA512 | b27641bfe7ed18b1ed8cb0d480b5c1e5ceb5dee4620c1c738e01db06295c6d48b8698ae420a42b490583278ee8166ea1d32a6e92520ea52169a28dc5945e9f5b |
C:\ProgramData\AMMYY\hr3
| MD5 | 15198d1c17607cb906658627232b3586 |
| SHA1 | b9a2ffe3b6abfdfef32addb702d9c78270ada8db |
| SHA256 | 46b2c199720c2544201ab5dee0db5ac545892c38a5cad06662ba14122e5be162 |
| SHA512 | bfa95f2ad565fc266ad19360840c606ebf93fe759cc6f8abbd284d49e95320e6c13075059ea20e87ae23724f8cc0b1ae95db92dcd9d734260fe9bcaa841a4540 |
memory/1964-35-0x0000000000400000-0x00000000004B9000-memory.dmp
memory/1964-36-0x00000000020F0000-0x0000000002163000-memory.dmp
memory/1964-49-0x00000000020F0000-0x0000000002163000-memory.dmp