Analysis Overview
SHA256
b29d4f97b9274450f159bd7e712738814b6643140be3ecb8e37a4c3aaec9354c
Threat Level: Known bad
The file 1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Ammyy Admin
AmmyyAdmin payload
FlawedAmmyy RAT
Ammyyadmin family
Checks computer location settings
UPX packed file
System Location Discovery: System Language Discovery
Unsigned PE
Modifies data under HKEY_USERS
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-06 19:13
Signatures
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Ammyyadmin family
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-06 19:13
Reported
2024-10-06 19:16
Platform
win7-20240708-en
Max time kernel
150s
Max time network
140s
Command Line
Signatures
Ammyy Admin
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
FlawedAmmyy RAT
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = a3db681464d418ec0be4e978859d469465e10366a57d7537e97e2cdfb4e925ac447106316002c90a2fc8163a0a8e9d559d4a00d3d355c6295e130297c86aa16e3c5e1601 | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c695f594c165453579052d56b47b36b | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2704 wrote to memory of 2808 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
| PID 2704 wrote to memory of 2808 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
| PID 2704 wrote to memory of 2808 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
| PID 2704 wrote to memory of 2808 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp |
Files
memory/1508-0-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/1508-7-0x0000000000400000-0x00000000004C3000-memory.dmp
C:\ProgramData\AMMYY\settings3.bin
| MD5 | a55567fceb74f9ca4f151f4ab84b68c7 |
| SHA1 | 63b4a57b258e640b165732dbcd0ca00fc69b4c8b |
| SHA256 | f649823939d0bf2b01f5c785e55d3e278c1ee7cc11b547c6644ac9f90996e9d7 |
| SHA512 | 3cbeb788c068008bdf2c7c19b696d464e66f66a969164cf98793e3150cf5ff82822de41deabb79921cbfcc93897ee824872c64a7bd9e131b1304105cad0f010f |
memory/2704-5-0x0000000000400000-0x00000000004C3000-memory.dmp
C:\ProgramData\AMMYY\hr
| MD5 | 1085abaedb36b4b648773116cc68382f |
| SHA1 | 1cd3239ed11568b30bb9a3f0cb1718a433293795 |
| SHA256 | 7c84603a3a4af06e5515f71e853221e963eaf11c8b217906bf28478752687b1f |
| SHA512 | 57fa52bc64eb7bbf406f69f72fd6d8563324cb5020403df9a0bd9745dc76bcdb221bd176727ab75b87d97b73cc89a4781b8ef3cec2b13e72109b3e076fa20f70 |
C:\ProgramData\AMMYY\hr3
| MD5 | 4d6fd5d79590e9f2f5b065bff4c8caca |
| SHA1 | 9536a0e198c8fc08ad2e65e620a508c9ea8c753c |
| SHA256 | 8c6190a06e0c5617b8862b5c8f35745cbfdb02c406b0ed6fe8718a5c26fefd48 |
| SHA512 | c9e0902ccff80eb75639d039d180c205bb8360112b1905e3ce6093603696e5772eba184363e096fa87b831af2352b6dd4a9d7004c6f74c695503b241e02dbccf |
memory/2808-12-0x0000000000400000-0x00000000004C3000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-06 19:13
Reported
2024-10-06 19:16
Platform
win10v2004-20240802-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
Ammyy Admin
AmmyyAdmin payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
FlawedAmmyy RAT
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525344380fd56b47b36b | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 88064717177b231daf091165e4d81c14497b460a1223c9d28ec8fde27f14cd7a130c0c3b7cd3bc1a3373e01af85b9899a21c4b5012f9d37f5f3248634d9919f804f23538b3cd246cd8cfb7 | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1704 wrote to memory of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
| PID 1704 wrote to memory of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
| PID 1704 wrote to memory of 4404 | N/A | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe" -service -lunch
C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1954f7c5cf2ed21665937051cdb8b9d4_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | rl.ammyy.com | udp |
| NL | 188.42.129.148:80 | rl.ammyy.com | tcp |
| DE | 136.243.104.235:443 | tcp | |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 148.129.42.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 235.104.243.136.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
Files
memory/2516-0-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/1704-4-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/2516-6-0x0000000000400000-0x00000000004C3000-memory.dmp
C:\ProgramData\AMMYY\settings3.bin
| MD5 | a55567fceb74f9ca4f151f4ab84b68c7 |
| SHA1 | 63b4a57b258e640b165732dbcd0ca00fc69b4c8b |
| SHA256 | f649823939d0bf2b01f5c785e55d3e278c1ee7cc11b547c6644ac9f90996e9d7 |
| SHA512 | 3cbeb788c068008bdf2c7c19b696d464e66f66a969164cf98793e3150cf5ff82822de41deabb79921cbfcc93897ee824872c64a7bd9e131b1304105cad0f010f |
C:\ProgramData\AMMYY\hr
| MD5 | 6066db6da458b212e6a837c8d90ff723 |
| SHA1 | f3909ff7c409e81c3430850ab1d96d7b09db0f84 |
| SHA256 | bb5d2f4a7b5fb6797672d7046e0238d0e04add79c9da2d7552e3abb17078d246 |
| SHA512 | 7ae9371308e9084753301bacfde5d7ec3b9bea322d3472c2aa0023feaddd93f9423b60ac7f3fc9184f13a7816ea6ca463b3010a30923954d9c1ed5d538008b2d |
C:\ProgramData\AMMYY\hr3
| MD5 | 63cfea488e130c0a4c5f6f2e1de702e5 |
| SHA1 | dcbf0d5cb2bab56d4bbc20ba62e467bb4974bd1e |
| SHA256 | b78437ec886f9436c8ffebb9dad0eaaf52265fbce3138052196861d64d211d6b |
| SHA512 | 66f8317277e69926348565ea2d484425fa969956c31e0ec908d01c84e159aa823d30f817d0d4435bb6f774a27dff2a51cce7ef9c7378e87c2500ed8c55b96638 |
memory/4404-11-0x0000000000400000-0x00000000004C3000-memory.dmp