flawedammyy | c06772a670fe75743120be30722d985d2e98d8af909b60ba7faaeb0ee9867646

General

Target

1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Size

700KB
MD5

1e874df2ee8682a263ced01f36abc5b5
SHA1

f105b9eccc8fbc38e550e0b4d39a27ff71c49d70
SHA256

c06772a670fe75743120be30722d985d2e98d8af909b60ba7faaeb0ee9867646
SHA512

3e4e3f557a7adacfefb067bb27d2e3b5a0d1c5300af62a93bfe2729616a5a0f6106cd8057ab6015edbb0a1bb2e7f36b378e93edf57692e0ba853a58d7df13a1b
SSDEEP

12288:lhjun1eaHjs7C8la0n9lp9Dkb1RtgA93ykM+TZtC3igL:zqeOs7C840n9lpG1Rtb93IKZtuL

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Control Panel\International\Geo\Nation	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c17525317e2ddc5ca46b36b	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 4f09e0394d5122909f081fd74356f895d1bb8a2e893982c4d0162aa6b71e50b8b36583f8dc54ec2d1ff3f509f99ed9b69fce1735f6392cc5cd8eca2cec35c461e4eca3d212380a9302b954	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2840	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2840	2812	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2840	2812	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2840	2812	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	31
PID 2812 wrote to memory of 2840	2812	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2276

C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
4c2a6958a7e6ec16701c19aafc2bbddf

SHA1
94da959c6bc59a242385062e62d87eed1a496f53

SHA256
7eeb81d5e52128860cd5488d03575b128caf5ed291d019fe9609f51c3ece5c01

SHA512
173e94ecb8b068a1609c8d6aa411dbb087d455857c281848245da6216ce55ec74a57f3f682cd6fdd0d353702ac3148b35f8271e29fb30cb1b2ee1514310bf24a

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
c0119bdff99c0467624c6bf3583be44a

SHA1
271fadca08fd6e5317d242d7c9cb743ac99e34d7

SHA256
d756f1136380e302008f35d0213ee42cce3beb269e90800bb35e6e75e25b1276

SHA512
629da60fa468cf9f05b29efa3a872e1279d14a64a21a81002eab209101027e18f90957d6be6e4d529f7477eae4028b93694d5b7375fc88d09b98d728df96f59a

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
305B

MD5
4d4bc796207936f0d1aec10aff4a6fbe

SHA1
d7539cf53098d65dc66d723493d1c1ed105118cb

SHA256
8f2f80489b99fd3c76f347404d4a926999f9b12a17338c76b2d6e4448d80ca1b

SHA512
5d43f0f0dc1494b7473ba2d08b3b3a33f319be74514624c9dc231a61daea773cba12c3a31f6e28c1320ac773c504994dbc94f0c8db30f46a19452cf8f6ceb785

Download Submit

Analysis

Sharing