Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 00:48
Behavioral task
behavioral1
Sample
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe
-
Size
716KB
-
MD5
ae1609bbc9632bc4c049412c34ce100a
-
SHA1
9fda0f6140e77b1479ee9829190ff7ecf021601c
-
SHA256
a9d30e9467e19dfb0dac7a925809b5c52c686977392ef45c9939022c5ff8c8b9
-
SHA512
2100a62c0d10da4d2fc9944f2930edd2d13e751457f4bc4736a8b3c199b6a4f359242a011863a42fa6a5c61e95441bb3855b986f56d28963dbcc70c822ec06d8
-
SSDEEP
12288:u2QKNGp2YPjE0d63iVg5Bfi781Rt1hpGqzdpW9eKVQvTPRpsbS5hlgN:uSIp2Ydd6SVcpz1RtXpGadsbSeN
Malware Config
Signatures
-
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
-
Flawedammyy family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exeae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exeae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c17525357a4dc6bb01eb36b ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = a389e7031c28346ec2458ac41176c1cedd59a6990608cac3a44719c92c44c43391a5ec9c262fb5a4003e361c497a3b66a7759327a168cc8b2d5620f115e49eecf2eb6ceb9348cb0b65f724 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exepid Process 2720 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exepid Process 2720 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exedescription pid Process procid_target PID 2864 wrote to memory of 2720 2864 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe 31 PID 2864 wrote to memory of 2720 2864 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe 31 PID 2864 wrote to memory of 2720 2864 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe 31 PID 2864 wrote to memory of 2720 2864 ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
PID:2068
-
C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe" -service -lunch1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD5b4b0002b970aa6baebfaf7333f100e47
SHA11d2d65f9531dbe8ea1485f340a3aa84d39efa830
SHA256b468e9413c72e7fda7adb693c36614bca9f3bc57625a60cc44195862271bbf25
SHA5128cd8947864a8c3a2251c0c308dda1e330d03d83b886d75ee4a6d121260dfb3f961365960a021680d670405b2fb6a9217b9fc22f9925219461158b0ed4849fe54
-
Filesize
75B
MD5a696c239168ee59a4e5860ef911c5c3d
SHA181b1e6ab88908a60efc9db645c1e1e234d9f9c79
SHA256d20c45429a37a10e9fbc0b08dfb2acb3386ab928d1642a6acb2a79a4967d7b8d
SHA5120b5386dc742ed4c345a4556c8b70409fee51ae15d36c0b0effcb48c62a98b7134c65b0368f8719dc3d69cfc226f9183fc795d416e1d7d67abf7ca2a5e7a32071
-
Filesize
282B
MD531cd4f8ac85a4c4ff93eed2cee2d6f42
SHA120104e017d48b3237ad4baf04e852b2a71dc6d9b
SHA2568ac86e1dc58c3d718ae5fc8dcb4bcd2e65b6cde3d6eac6532b75f3ec5fa7c8ab
SHA512a9e8a264c59db8188837be062da155155ebc04fed270b278f89c92366611fba226ad78924faa5e4fa43238fdaf13c3024ab0ef0533ae3b40fdb6b9c1ae5d42e4