Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15-12-2024 12:04

General

  • Target

    f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe

  • Size

    267KB

  • MD5

    f3ea0b41143e7afc6221f42f2503653c

  • SHA1

    c3eb377ed5ad63ad7a5fc6fd73d4101c928dac64

  • SHA256

    5512c8b42e96b051ad12fbab36689d10860d807f258a6bc1c77b4b110db5bb8e

  • SHA512

    610feccd8e78ec57a687d412e87519d4bf780aa347ee3068d9d692b263c270a96cf44b6510f7fc4a862dda0c83e062ccaf90a05a17bd16f6d8256ed51f100cfd

  • SSDEEP

    6144:OnUt0y4KIZwZIa+kP63kiYH6NyEyF3Ved54RTeJq:OnU2FHatipBNyEyF3Ve+TT

Malware Config

Signatures

  • Ammyy Admin

    Remote admin tool with various capabilities.

  • AmmyyAdmin payload 3 IoCs
  • Ammyyadmin family
  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Flawedammyy family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 5 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2828
  • C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe" -service -lunch
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AMMYY\settings.bin

    Filesize

    76B

    MD5

    090bba5cbe9cd62189310f633f14d686

    SHA1

    0ce1d78aace04650b0c592665686a89412c1771c

    SHA256

    7bc48188bbd0ad1b7ac10257e6a8fc5327f2ccfd56402a4353f6d8ef26eb0ff8

    SHA512

    846781bdb4d8902963f1859077c8db4c763fdd4ca28f0be83b95c20d324b5db030f312fc3d4f959dc05ca4f41ef872a49d123195494b16440e16ebcc5edb31a7

  • C:\Users\Admin\AppData\Local\Temp\f3ea0b41143e7afc6221f42f2503653c_JaffaCakes118.log

    Filesize

    162B

    MD5

    c4a69303c2fac4209b7a7d38db75711f

    SHA1

    31abf3aa0e81b85977acbdfeeebbe861dae4f8da

    SHA256

    4a0e95105aa7234922fd93abc61131121665222bdc4d7e86a7fd01722522a3b6

    SHA512

    2858a3dec4395b69b8b1d43a7ee16511e2c6128789ef70e0774c56488eaed65cff7aa4e05526e2b6e70e926ff782c12dfb3362e208775514576f20d0c6a2eaa0

  • memory/2740-7-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/2740-21-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/2828-0-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/2828-10-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/3064-3-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB

  • memory/3064-9-0x0000000000400000-0x0000000000497000-memory.dmp

    Filesize

    604KB