flawedammyy | 8d6878dd7a05b9402efa6824ea82613fa6785187ec878823a387adabc2cd6965

General

Target

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Size

701KB
MD5

b9b5ca19815cd592e7a4113076839b7c
SHA1

e66f3cc9131ef224800f496d26854d6699f72b70
SHA256

8d6878dd7a05b9402efa6824ea82613fa6785187ec878823a387adabc2cd6965
SHA512

c7a721d782a46b59b866fada56c904713f118d883fdd19863bd3f53113f18c168e7db70ab1cb8e751aead1a17fd8b8463b3c09dedb9b3e372503075a9e39ad99
SSDEEP

12288:aZsgrzAe9zLbMmop7HxLp5x1Rtr79Oj8TmwZxEiga6:mIe9zMmoZHxB1Rtf9Y8TmwZxQa6

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exeb9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exeb9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c17525337271bd8a41bb36b	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 14db2a47616f08270fe4e978859d3848023f2c343f8e97bcbb34cbd8efca2e277b8156c977112400f27d764dc5da10beec003bbe4581d59873ca4e8a59e9cbcc83547b31c121b00c1fd2ae	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

pid	Process
2412	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

Suspicious use of SendNotifyMessage 1 IoCs

Processes:

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

pid	Process
2412	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe

description	pid	Process	procid_target
PID 2396 wrote to memory of 2412	2396	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2412	2396	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2412	2396	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe	31
PID 2396 wrote to memory of 2412	2396	b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:840

C:\Users\Admin\AppData\Local\Temp\b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\b9b5ca19815cd592e7a4113076839b7c_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
94a0da3bb03a282e67743765f220ec06

SHA1
0486d4a5b704e88fa5f9fc1981eb561bf60490ee

SHA256
227d69ceb461b7c1d06d7ce45e1e3817c4800db9d9820a1f49c42b32e37ff92e

SHA512
4f7e5069c27507976731640eec444d6872a4c1738d34dd37c884e581a7c89af9bf827c850277cb3d60c0707251297f1328e1c919e54b3ff23d6c38f1fd994945

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
2716b8c76ba47cd2d61d5e7f1a7359d9

SHA1
c7f0ebd9f27f2e0d844fcfd63df43167c16eefdb

SHA256
b9e15e5ecb920f8319c37e5bc5350b9e005222eb5d125844740588c97acf25f7

SHA512
80f3a48d7284a6a6d1c4d67d6b924e7ada9361a8eb7d2f660740ba563403078885d2d4037c6b4509936e247fc8de812125e6e72c299f801d6718b8c4328590a8

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads