Malware Analysis Report

2025-01-23 12:19

Sample ID 241129-a5r4kswqgx
Target ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118
SHA256 a9d30e9467e19dfb0dac7a925809b5c52c686977392ef45c9939022c5ff8c8b9
Tags
ammyyadmin flawedammyy discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a9d30e9467e19dfb0dac7a925809b5c52c686977392ef45c9939022c5ff8c8b9

Threat Level: Known bad

The file ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ammyyadmin flawedammyy discovery trojan

AmmyyAdmin payload

Ammyyadmin family

Flawedammyy family

FlawedAmmyy RAT

Checks computer location settings

Drops file in System32 directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-29 00:48

Signatures

AmmyyAdmin payload

Description Indicator Process Target
N/A N/A N/A N/A

Ammyyadmin family

ammyyadmin

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-29 00:48

Reported

2024-11-29 00:50

Platform

win7-20240903-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"

Signatures

FlawedAmmyy RAT

trojan flawedammyy

Flawedammyy family

flawedammyy

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c17525357a4dc6bb01eb36b C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = a389e7031c28346ec2458ac41176c1cedd59a6990608cac3a44719c92c44c43391a5ec9c262fb5a4003e361c497a3b66a7759327a168cc8b2d5620f115e49eecf2eb6ceb9348cb0b65f724 C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.235:443 tcp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 31cd4f8ac85a4c4ff93eed2cee2d6f42
SHA1 20104e017d48b3237ad4baf04e852b2a71dc6d9b
SHA256 8ac86e1dc58c3d718ae5fc8dcb4bcd2e65b6cde3d6eac6532b75f3ec5fa7c8ab
SHA512 a9e8a264c59db8188837be062da155155ebc04fed270b278f89c92366611fba226ad78924faa5e4fa43238fdaf13c3024ab0ef0533ae3b40fdb6b9c1ae5d42e4

C:\ProgramData\AMMYY\hr

MD5 b4b0002b970aa6baebfaf7333f100e47
SHA1 1d2d65f9531dbe8ea1485f340a3aa84d39efa830
SHA256 b468e9413c72e7fda7adb693c36614bca9f3bc57625a60cc44195862271bbf25
SHA512 8cd8947864a8c3a2251c0c308dda1e330d03d83b886d75ee4a6d121260dfb3f961365960a021680d670405b2fb6a9217b9fc22f9925219461158b0ed4849fe54

C:\ProgramData\AMMYY\hr3

MD5 a696c239168ee59a4e5860ef911c5c3d
SHA1 81b1e6ab88908a60efc9db645c1e1e234d9f9c79
SHA256 d20c45429a37a10e9fbc0b08dfb2acb3386ab928d1642a6acb2a79a4967d7b8d
SHA512 0b5386dc742ed4c345a4556c8b70409fee51ae15d36c0b0effcb48c62a98b7134c65b0368f8719dc3d69cfc226f9183fc795d416e1d7d67abf7ca2a5e7a32071

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-29 00:48

Reported

2024-11-29 00:50

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"

Signatures

FlawedAmmyy RAT

trojan flawedammyy

Flawedammyy family

flawedammyy

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 1ec7f509ec92ec04b10364f7bdc342fefff822fef39fc00a2e7f4a9687b4a6a9d513ba6986197027d3da1698ae6d2ebf3188d887924b57102e6ec4960f392ffd78b18fb96ea5cc9f32fcd8 C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253ff4e936bb01eb36b C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe" -service -lunch

C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae1609bbc9632bc4c049412c34ce100a_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 rl.ammyy.com udp
NL 188.42.129.148:80 rl.ammyy.com tcp
DE 136.243.104.235:443 tcp
US 8.8.8.8:53 148.129.42.188.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 235.104.243.136.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp

Files

C:\ProgramData\AMMYY\settings3.bin

MD5 31cd4f8ac85a4c4ff93eed2cee2d6f42
SHA1 20104e017d48b3237ad4baf04e852b2a71dc6d9b
SHA256 8ac86e1dc58c3d718ae5fc8dcb4bcd2e65b6cde3d6eac6532b75f3ec5fa7c8ab
SHA512 a9e8a264c59db8188837be062da155155ebc04fed270b278f89c92366611fba226ad78924faa5e4fa43238fdaf13c3024ab0ef0533ae3b40fdb6b9c1ae5d42e4

C:\ProgramData\AMMYY\hr

MD5 4a5758c90a623495ce4a15f589da3ae3
SHA1 5c31e1b647c7b05dd478dbffd34f83aa6c6556a0
SHA256 f812ac2d6b89e21d9fa8fb86e2a1a64b8f73d63e1ccf25a6f6f17cd1bc770fae
SHA512 f321aa8de4b7a7853078414907822b030467b40044ef93d165e64eb74d9933cba6db334f3da185851b95a9d7742d6ef54bcd94677514eeef659d0af033f92023

C:\ProgramData\AMMYY\hr3

MD5 7c873624e380cd71563db9cafe12a6c0
SHA1 25385b98b85c26f5640aebb9d0aa1239b3f5b456
SHA256 8ed032b22630dcfe833d5688bafca7efcf9370903c61403dec590bde20d4e8e8
SHA512 22d8fb2af06b47bceff53a8ecec8494665c9326e4b51b0215f428f702314c0937dce796f9e440724c0ffd1bc070eeb9190b1acc5c43c30f1cccaff6f2d85915f