Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 13:08
Behavioral task
behavioral1
Sample
3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe
-
Size
768KB
-
MD5
3a2e6d51b199bb631eea59c8cac27902
-
SHA1
18dc174c9a25f5dcf1777cfeed0e97b5c5f7eb4c
-
SHA256
bca57f1b02cb2521fbcbb1f36f99dc2e47ec6df6bc88f24ec000b96c0f032592
-
SHA512
662c75d6964317b8bb7d451a543f3da28e134d22dd558f677c3d357e413e243efe775a6ba562071257d07e8318569bd751d08100f5353b9821ed7d2bccefc6d5
-
SSDEEP
12288:jXe1Z2fJipMHEgSeA6M7kmchJGvRuORtcE9qTpy+Yg0HkV+UgWRDkj9tyTEAjRc0:ztkmHEgSewkmchJGsORtn9qT8+Yg03ZU
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 48 1440 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 1440 rundll32.exe -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A82946818BB0433A7DC1AFD2189B16AF 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A82946818BB0433A7DC1AFD2189B16AF 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe -
Modifies data under HKEY_USERS 14 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 66cf3269252c7cdf122ad98140a2855f093996ec0dc28435f6581e5af92a970c26b16dc69e68629676c3502afe00b6e180b244d38e3b4abababe5b2faec5a836900be4fc51fe581a2363f5 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe 1440 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLockMemoryPrivilege 1440 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2164 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2164 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4940 wrote to memory of 2164 4940 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe 84 PID 4940 wrote to memory of 2164 4940 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe 84 PID 4940 wrote to memory of 2164 4940 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe 84 PID 2164 wrote to memory of 1440 2164 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe 90 PID 2164 wrote to memory of 1440 2164 3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:3620
-
C:\Users\Admin\AppData\Local\Temp\3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe" -service -lunch1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a2e6d51b199bb631eea59c8cac27902_JaffaCakes118.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",run3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
902KB
MD5480a66902e6e7cdafaa6711e8697ff8c
SHA16ac730962e7c1dba9e2ecc5733a506544f3c8d11
SHA2567eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5
SHA5127d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5
-
Filesize
4KB
MD571da950ee45b570a27917b70d733adda
SHA1d22dc46f2a730b2124f74b8e1b312c8cddf6dbb2
SHA2564e7545ccbf72ef0598424910626db55acfa90718964dc0632870aca315e7f225
SHA512f3120fd488813cc017c3a91b49af08fdea9914f3d3954142409b04104414b4155eb7e46f47c761233d8edd68e80d3a314dfbf172ba9ca5d139832a301451bd67
-
Filesize
45B
MD5f5d867c23b8cac17baecc8cd2ac118b9
SHA1ab0da5d10496611ae18f28822c32507aa531dfc4
SHA25652ebeac5f05e8e12afb680e5e291b41a440cc7dbb812fddd075b6f7586c4fd2b
SHA5121a067037fb1a8f6782681902e6dc391e399c5caf3e430bdacc30d2cd36985d4eff72359d676e7799dbac3f2f58f697181934a67af18a366cb58a69e6f56e837d
-
Filesize
316B
MD5b76abe6342b5f0f93ed93ebe3ecf3d58
SHA11584113b9bb8f75a2fb2e50f55b9d4aa0da809a5
SHA2560dc6df67d820bc53f90333843bbe182466530f83bd86d9f440a772bf51daf414
SHA512058897103b6bafe76d419deca68ff2e83c09cbd8e5a96063d0f0ca73d23bbe2748cc1fdfac2140af89d5ad0e9637bc2ad9901824eeb0ea2079f99b266ecf51d8