ammyyadmin | 304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2

Analysis

max time kernel
120s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Size

766KB
MD5

fb975974833411caa02f60e99801aeb0
SHA1

cabaee807c9cada7188323e9c780131481c076da
SHA256

304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2
SHA512

7090df5b5ea5e39e8a4c5ff282c46ddcd6199d4d576639395121c78af653c7997a9f839d96e96d934b4f26c42c139d707fad2292da8563af1156b4aa6f694aea
SSDEEP

12288:gpDNc/Xsfu2LVBRKf057C9lRt3i5olGJsxhzagJYa:g5N48fu2hBRK8ilRty5olGJsxNSa

Score

10^/10

ammyyadmin flawedammyy discovery persistence rat spyware stealer trojan

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c87-4.dat	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Executes dropped EXE 3 IoCs

pid	Process
4704	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
3416	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
2300	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cttune.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\Dism\DismHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\hdwwiz.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\ntprint.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\ttdinject.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\cleanmgr.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\cscript.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\fsutil.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\msra.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\rdrleakdiag.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\certutil.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\isoburn.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\ndadmin.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\powercfg.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\relog.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\Windows.WARP.JITService.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\WWAHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\bitsadmin.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\certreq.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\fontdrvhost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\getmac.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_ssp.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\TSTheme.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\CredentialUIBroker.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\nslookup.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\reg.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\rundll32.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\SystemUWPLauncher.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\fsquirt.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\iscsicli.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\quickassist.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\rekeywiz.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\SearchIndexer.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\wermgr.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\edpnotify.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_ssp_isv.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\AtBroker.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\dpapimig.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\lodctr.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\logagent.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\mobsync.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\RunLegacyCPLElevated.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\SettingSyncHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesRemote.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\tzutil.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\wusa.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\dxdiag.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\expand.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setup.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\mtstocom.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\provlaunch.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\sethc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\shrpubw.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\tasklist.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WMIC.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\whoami.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SysWOW64\wiaacmgr.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_fa551ac355d48c7f\fontview.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\lpksetup.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\SyncHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\WMIADAP.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.19041.1_none_c9c6a551071df37e\PresentationHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_99318cb064fcaf44\mscorsvw.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_5c4f760174b23886\resmon.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1_none_8591bd54bdb2be6f\AtBroker.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_03029e85abc99279\bitsadmin.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_cd761f3a5c1f786f\auditpol.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.1_none_7c197eeaa6d7861f\SndVol.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UNPUXHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_afdc734db4fba076\takeown.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_cd1cbc8db3875f47\csc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.19041.1_none_c8306252df9627cb\rekeywiz.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_d4adcbe768a8354a\aspnet_regsql.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_bc34aea0c10c4a99\setupugc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\wecutil.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.19041.1_none_ddb8055b31c2ae64\proquota.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.264_none_39a33f9dfdb389ae\slui.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\audit.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\sftp.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15805.0_none_0606cd4b5dabfc56\MSBuild.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.19041.1_none_38a57ff5dba3c9f4\ngen.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\aspnetca.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\msinfo32.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.1_none_2d66868246722e10\OpenWith.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\GamePanel.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\systemreset.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_f89a6b0476f024dd\wab.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_96edd00e05696409\vbc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File created	C:\Windows\svchost.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_af96916428136673\mobsync.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvax64.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\wscript.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_8ec2362c55947137\whoami.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\servicing\TrustedInstaller.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\FileHistory.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.1_none_735c6874d3056a0a\ofdeploy.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_1fe6ae13cb971ac8\netsh.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.1_none_76b501b13155d66b\WmsSvc.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\setup_wm.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\b6c0024236e5d701ea9600001815341f.eshell.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\dfrgui.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253a229d8b5ff75b36b	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = daf96c6368dab04515543c567d07a4ab19a62f4465fc635f3a1d542e72adb53db29f90f9f777f60ef13229efb64199a1d693a998c870cbcecdeaeb9af363d3cbd3ce4525841fb7c29c7082	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*"	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2300	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4704	4832	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe	84
PID 4832 wrote to memory of 4704	4832	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe	84
PID 4832 wrote to memory of 4704	4832	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe	84
PID 3416 wrote to memory of 2300	3416	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe	86
PID 3416 wrote to memory of 2300	3416	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe	86
PID 3416 wrote to memory of 2300	3416	304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe	86

C:\Users\Admin\AppData\Local\Temp\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
"C:\Users\Admin\AppData\Local\Temp\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
  C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4704

C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
"C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe" -service -lunch
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
25e1390a66f7170a20124699caec1b24

SHA1
25ae756675a9e8617862295d1e815aa0a2522367

SHA256
c7de5d66d2f375cdeb2b62b3fd149c5ebf498395beb31592f4f2d1fcac9e5861

SHA512
9c0c27764031ff8c2259ae86dc9e515bff8b1fc4f9f70cda404e000af5352db683e3410615d3ceb435fc973081e808f271c63fb442601ecc1a125458b85e3930

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
9a807340b85888f264fd4beaef73f4b2

SHA1
86332dede9a9b382e363d3add3fa2d07159e8610

SHA256
40ad84357a0cbcf5c2e536e361e4d9ba36c6c976a276bcd98cfd1c71c71977bc

SHA512
f5cad47dadf2877807174e3d9200addc84e5c39e9b7115e6c07411713ecded6e654125a8ee856bb3adfc94c22881f18a36b02b3967aa0668362fe6c7bd54562a

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
271B

MD5
4cb889e527b0d0781a17f6c2dd968129

SHA1
6a6a55cd5604370660f1c1ad1025195169be8978

SHA256
2658cd46dd49335e739cafa31ff2ec63f3315b65ecc171a0f7612713d3ac702b

SHA512
297d2c05d2ac950faeb519d3e7bc56ea9d9fcab65b5dfdbba2720be8eddc8b2d5ead3dc7c122b82d6937be6c2d7bb88872dd7b80961138571245fba381daac3f

Download Submit
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

Filesize
674KB

MD5
0e52a8215012052d9c633778de5fdf27

SHA1
0abb5785385c3d584faf56c2e099d5d77fd5bb27

SHA256
b49e53cb15c09a2e2eab42f830e62e7314a06138222c441c7d0a3e1dec577b89

SHA512
e1c3f9153adb6d8d80fa9bbe88cb6d0b3acb76a648831ec12d5bda8b4dd99082bb0b10a02428548358850755d74d476b77cebe3657023f785bd1705d42eaaa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8432\304767a5d161c49053fcb983a007c4ec90290a8bc7f61eb7539bbb7b9a5558c2N.exe

Filesize
726KB

MD5
3178f23055b264687995248286a1203b

SHA1
cf90f321c3cccb006698c4665ec65172c221d979

SHA256
7895cba4fd1a4f2b5679e8fea1c5b5cbff35ece25dc7e64d49e9de98e52193c8

SHA512
94ca4626f83260edafc2c36346c33be0f12bd46d93b18b4ea336e82e5db1be857f41d475a40913343ad6dfe61bfcaa13fbc75a6853b3f7e071b2580f9aa065ef

Download Submit
memory/4832-74-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4832-76-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4832-78-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads