Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2024 00:48

General

  • Target

    ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

  • Size

    716KB

  • MD5

    ae1609bbc9632bc4c049412c34ce100a

  • SHA1

    9fda0f6140e77b1479ee9829190ff7ecf021601c

  • SHA256

    a9d30e9467e19dfb0dac7a925809b5c52c686977392ef45c9939022c5ff8c8b9

  • SHA512

    2100a62c0d10da4d2fc9944f2930edd2d13e751457f4bc4736a8b3c199b6a4f359242a011863a42fa6a5c61e95441bb3855b986f56d28963dbcc70c822ec06d8

  • SSDEEP

    12288:u2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hlgN:uSIp2Ydd6SVcpz1RtXpGadsbSeN

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Flawedammyy family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2068
  • C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe" -service -lunch
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AMMYY\hr

    Filesize

    22B

    MD5

    b4b0002b970aa6baebfaf7333f100e47

    SHA1

    1d2d65f9531dbe8ea1485f340a3aa84d39efa830

    SHA256

    b468e9413c72e7fda7adb693c36614bca9f3bc57625a60cc44195862271bbf25

    SHA512

    8cd8947864a8c3a2251c0c308dda1e330d03d83b886d75ee4a6d121260dfb3f961365960a021680d670405b2fb6a9217b9fc22f9925219461158b0ed4849fe54

  • C:\ProgramData\AMMYY\hr3

    Filesize

    75B

    MD5

    a696c239168ee59a4e5860ef911c5c3d

    SHA1

    81b1e6ab88908a60efc9db645c1e1e234d9f9c79

    SHA256

    d20c45429a37a10e9fbc0b08dfb2acb3386ab928d1642a6acb2a79a4967d7b8d

    SHA512

    0b5386dc742ed4c345a4556c8b70409fee51ae15d36c0b0effcb48c62a98b7134c65b0368f8719dc3d69cfc226f9183fc795d416e1d7d67abf7ca2a5e7a32071

  • C:\ProgramData\AMMYY\settings3.bin

    Filesize

    282B

    MD5

    31cd4f8ac85a4c4ff93eed2cee2d6f42

    SHA1

    20104e017d48b3237ad4baf04e852b2a71dc6d9b

    SHA256

    8ac86e1dc58c3d718ae5fc8dcb4bcd2e65b6cde3d6eac6532b75f3ec5fa7c8ab

    SHA512

    a9e8a264c59db8188837be062da155155ebc04fed270b278f89c92366611fba226ad78924faa5e4fa43238fdaf13c3024ab0ef0533ae3b40fdb6b9c1ae5d42e4