Malware Analysis Report

2024-10-16 05:08

Sample ID 241006-xxjhssvfpd
Target 1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118
SHA256 b29d4f97b9274450f159bd7e712738814b6643140be3ecb8e37a4c3aaec9354c
Tags
upx ammyyadmin flawedammyy discovery rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b29d4f97b9274450f159bd7e712738814b6643140be3ecb8e37a4c3aaec9354c

Threat Level: Known bad

The file 1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

upx ammyyadmin flawedammyy discovery rat trojan

Ammyy Admin

AmmyyAdmin payload

FlawedAmmyy RAT

Ammyyadmin family

Checks computer location settings

UPX packed file

System Location Discovery: System Language Discovery

Unsigned PE

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-06 19:13

Signatures

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Ammyyadmin family

ammyyadmin

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-06 19:13

Reported

2024-10-06 19:16

Platform

win7-20240708-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = a3db681464d418ec0be4e978859d469465e10366a57d7537e97e2cdfb4e925ac447106316002c90a2fc8163a0a8e9d559d4a00d3d355c6295e130297c86aa16e3c5e1601 C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c695f594c165453579052d56b47b36b C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.235:443 tcp

Files

memory/1508-0-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/1508-7-0x0000000000400000-0x00000000004C3000-memory.dmp

C:\ProgramData\AMMYY\settings3.bin

MD5 a55567fceb74f9ca4f151f4ab84b68c7
SHA1 63b4a57b258e640b165732dbcd0ca00fc69b4c8b
SHA256 f649823939d0bf2b01f5c785e55d3e278c1ee7cc11b547c6644ac9f90996e9d7
SHA512 3cbeb788c068008bdf2c7c19b696d464e66f66a969164cf98793e3150cf5ff82822de41deabb79921cbfcc93897ee824872c64a7bd9e131b1304105cad0f010f

memory/2704-5-0x0000000000400000-0x00000000004C3000-memory.dmp

C:\ProgramData\AMMYY\hr

MD5 1085abaedb36b4b648773116cc68382f
SHA1 1cd3239ed11568b30bb9a3f0cb1718a433293795
SHA256 7c84603a3a4af06e5515f71e853221e963eaf11c8b217906bf28478752687b1f
SHA512 57fa52bc64eb7bbf406f69f72fd6d8563324cb5020403df9a0bd9745dc76bcdb221bd176727ab75b87d97b73cc89a4781b8ef3cec2b13e72109b3e076fa20f70

C:\ProgramData\AMMYY\hr3

MD5 4d6fd5d79590e9f2f5b065bff4c8caca
SHA1 9536a0e198c8fc08ad2e65e620a508c9ea8c753c
SHA256 8c6190a06e0c5617b8862b5c8f35745cbfdb02c406b0ed6fe8718a5c26fefd48
SHA512 c9e0902ccff80eb75639d039d180c205bb8360112b1905e3ce6093603696e5772eba184363e096fa87b831af2352b6dd4a9d7004c6f74c695503b241e02dbccf

memory/2808-12-0x0000000000400000-0x00000000004C3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-06 19:13

Reported

2024-10-06 19:16

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"

Signatures

Ammyy Admin

rat ammyyadmin

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

FlawedAmmyy RAT

trojan flawedammyy

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525344380fd56b47b36b C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 88064717177b231daf091165e4d81c14497b460a1223c9d28ec8fde27f14cd7a130c0c3b7cd3bc1a3373e01af85b9899a21c4b5012f9d37f5f3248634d9919f804f23538b3cd246cd8cfb7 C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.235:443 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 235.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/2516-0-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/1704-4-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/2516-6-0x0000000000400000-0x00000000004C3000-memory.dmp

C:\ProgramData\AMMYY\settings3.bin

MD5 a55567fceb74f9ca4f151f4ab84b68c7
SHA1 63b4a57b258e640b165732dbcd0ca00fc69b4c8b
SHA256 f649823939d0bf2b01f5c785e55d3e278c1ee7cc11b547c6644ac9f90996e9d7
SHA512 3cbeb788c068008bdf2c7c19b696d464e66f66a969164cf98793e3150cf5ff82822de41deabb79921cbfcc93897ee824872c64a7bd9e131b1304105cad0f010f

C:\ProgramData\AMMYY\hr

MD5 6066db6da458b212e6a837c8d90ff723
SHA1 f3909ff7c409e81c3430850ab1d96d7b09db0f84
SHA256 bb5d2f4a7b5fb6797672d7046e0238d0e04add79c9da2d7552e3abb17078d246
SHA512 7ae9371308e9084753301bacfde5d7ec3b9bea322d3472c2aa0023feaddd93f9423b60ac7f3fc9184f13a7816ea6ca463b3010a30923954d9c1ed5d538008b2d

C:\ProgramData\AMMYY\hr3

MD5 63cfea488e130c0a4c5f6f2e1de702e5
SHA1 dcbf0d5cb2bab56d4bbc20ba62e467bb4974bd1e
SHA256 b78437ec886f9436c8ffebb9dad0eaaf52265fbce3138052196861d64d211d6b
SHA512 66f8317277e69926348565ea2d484425fa969956c31e0ec908d01c84e159aa823d30f817d0d4435bb6f774a27dff2a51cce7ef9c7378e87c2500ed8c55b96638

memory/4404-11-0x0000000000400000-0x00000000004C3000-memory.dmp