flawedammyy | 6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AA_v3.5.exe
Size

746KB
MD5

f8cd52b70a11a1fb3f29c6f89ff971ec
SHA1

6a0c46818a6a10c2c5a98a0cce65fbaf95caa344
SHA256

6f2258383b92bfaf425f49fc7a5901bfa97a334de49ce015cf65396125c13d20
SHA512

987b6b288a454b6198d4e7f94b7bba67cafe37f9654cd3cd72134a85958efd2125596ae48e66a8ee49ee3f4199dac7f136e1831f2bf4015f25d2980f0b866abe
SSDEEP

12288:PUYpJqMH2OwlaUPcWWw5XZV8f64RteVpN5ETMasTjcP6gX:zpJJWOwlaUPcWWwRZb4Rt+N5WMasHoX

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AA_v3.5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AA_v3.5.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	AA_v3.5.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.5.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AA_v3.5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA_v3.5.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253ff658454a040b36b	AA_v3.5.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 1ed671398d53818827c9418cf8730d30591e6871628833f6f27aecc141060ac7d0c68963013428b0a0414db6b29ff18c7bc548aa6986be5bdbd25ea98a58971c272200ca80cc918ec4a62a	AA_v3.5.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3760	AA_v3.5.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3760	AA_v3.5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 3760	3048	AA_v3.5.exe	85
PID 3048 wrote to memory of 3760	3048	AA_v3.5.exe	85
PID 3048 wrote to memory of 3760	3048	AA_v3.5.exe	85

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1768

C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe
  "C:\Users\Admin\AppData\Local\Temp\AA_v3.5.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
b781a14f43a22fcd08570daf18f2dcd3

SHA1
81ba1af9238b36fe0dddd020a53998019a83366b

SHA256
5fc3f08f43bfb907f0becc4dc1623d3af77f38e2671d574c34249ecfa51d8359

SHA512
1e5095c123fae71c4fd8db5d72986c41fa19310dd644eb2758a802094c99eda398051f857234b20215195d70341ea6871cc08657f720264e377487fe402e916d

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
4fc4145bc6589439a7f95a6166271c75

SHA1
42e8dd66020edb182ea13d3f97c7dc7b5822615d

SHA256
e9395cc06059cc4dce91260f3250e50b71a3a8a9624b305328967b977c6d855f

SHA512
8b76764857766b10a69f231c5d6422cd86115151a8d56cb5fcba72b8f3b6353d100096de4edd5e6d311393274c7059d14904f657dd8098cbbedcda3c82d63c6d

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
714f2508d4227f74b6adacfef73815d8

SHA1
a35c8a796e4453c0c09d011284b806d25bdad04c

SHA256
a5579945f23747541c0e80b79e79375d4ca44feafcd425ee9bd9302e35312480

SHA512
1171a6eac6d237053815a40c2bcc2df9f4209902d6157777377228f3b618cad50c88a9519444ed5c447cf744e4655272fb42dabb567df85b4b19b1a2f1d086d8

Download Submit