flawedammyy | c06772a670fe75743120be30722d985d2e98d8af909b60ba7faaeb0ee9867646

Analysis

max time kernel
150s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2024 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Size

700KB
MD5

1e874df2ee8682a263ced01f36abc5b5
SHA1

f105b9eccc8fbc38e550e0b4d39a27ff71c49d70
SHA256

c06772a670fe75743120be30722d985d2e98d8af909b60ba7faaeb0ee9867646
SHA512

3e4e3f557a7adacfefb067bb27d2e3b5a0d1c5300af62a93bfe2729616a5a0f6106cd8057ab6015edbb0a1bb2e7f36b378e93edf57692e0ba853a58d7df13a1b
SSDEEP

12288:lhjun1eaHjs7C8la0n9lp9Dkb1RtgA93ykM+TZtC3igL:zqeOs7C840n9lpG1Rtb93IKZtuL

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253d13d6d32cb46b36b	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 416f1b93e581e33045a25477da69f0ae9bf209734ee29249806a271302f97fd4811dbe4481908ef142f133759c91f261439cf9ca15923ecd81d85692f06c501fe3d7edf92a72b19efc4ab3	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2992	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2992	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2992	2388	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	84
PID 2388 wrote to memory of 2992	2388	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	84
PID 2388 wrote to memory of 2992	2388	1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5072

C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\1e874df2ee8682a263ced01f36abc5b5_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
f47916c9f550120f1475510e7220ccc4

SHA1
46db0747dfcc057f174a67eb985c72fabfb002de

SHA256
b5632a93219f50c3871d50781541ca3300942114865c806ee24588704099d2d4

SHA512
fe6cb3b88c2037ec8240855519518fea74067b8fb075c184d82fd9c29c8526c4fb1c12f6facda410faa2b89333a74a14f2f2b9004fd870c3a6da0332f12c3487

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
9639c332f6e9165b9d1e5161ff4d6209

SHA1
b45fa6aa92be2b4e38da1554e7d791a7f7a4bbe9

SHA256
13614b28f974dfc88dee7042fba6d7b7081b590673a416c45133059d41983545

SHA512
df28a4329e563635c37d5de3ade00cf3e738718bc3d3922583bb19fb3bf44f791cc04ee57c89aa740170b39c2680f5b02e3bc4af73614e7e6fe4462620f79bad

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
305B

MD5
4d4bc796207936f0d1aec10aff4a6fbe

SHA1
d7539cf53098d65dc66d723493d1c1ed105118cb

SHA256
8f2f80489b99fd3c76f347404d4a926999f9b12a17338c76b2d6e4448d80ca1b

SHA512
5d43f0f0dc1494b7473ba2d08b3b3a33f319be74514624c9dc231a61daea773cba12c3a31f6e28c1320ac773c504994dbc94f0c8db30f46a19452cf8f6ceb785

Download Submit