Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2025, 09:49

General

  • Target

    JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe

  • Size

    720KB

  • MD5

    6bc5c1e1e9b7647b14ee5ffd0f53abd0

  • SHA1

    3c9d020fab99d225a5b269901e226cb3d3c18bb8

  • SHA256

    a6f814b525fbedec982f569c29d67cb11fb232ae5951eba4ecb6f62a2eeefb9c

  • SHA512

    6cd0464098b45b6444985e9902070b7dfc3f4228a7d6445ac1e3a949f2b4fa3f9b8045a1d165309406605fec55eb93e248797ef9a076959defdad532626e97de

  • SSDEEP

    12288:PYdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzVEg4:wdNikfu2hBfK8ilRty5olGJsxd4

Malware Config

Signatures

  • FlawedAmmyy RAT

    Remote-access trojan based on leaked code for the Ammyy remote admin software.

  • Flawedammyy family
  • Drops file in System32 directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2656
  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe" -service -lunch
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6bc5c1e1e9b7647b14ee5ffd0f53abd0.exe"
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\AMMYY\hr

    Filesize

    22B

    MD5

    afcd020a6d2803ce1d552f9627bb5a25

    SHA1

    5b955d3f4d56c6742f77063a3019af73207b7e18

    SHA256

    b3ead8490f07847901ae7f81bd0aeea3947f53811320c688448b1f51cb01c6e8

    SHA512

    1c6a2130e0dfaad61fef7a80a46cff66cc6368c1b3ff5b3f20d9f5e1f29664da8c9f93a3992debeed36dbb4ca92c558c073a02c29546b84c92154b6443305f5e

  • C:\ProgramData\AMMYY\hr3

    Filesize

    75B

    MD5

    cfb0e90eaa2538f938d0c87efcaedada

    SHA1

    44bdd32eb0c702a79d43b67a1f68523229266fb6

    SHA256

    9a147f20f6e1e844133717de6bec7ae935115b66173c624f15fe95d3e2a57187

    SHA512

    ce1d8ceb6aca5fdf57ab6dee85be1ced215015e2c218c77654a7b3561e20056329cc74d97cdf8371adbc4eeeb3a9890f1c2fa3266a3c04c3e0220f275858921b

  • C:\ProgramData\AMMYY\settings3.bin

    Filesize

    307B

    MD5

    6d41ae530d5f0c5531a343fb58a856ba

    SHA1

    c15b36f055c1cb7b5f743c7123e6a79ebfbb1eb1

    SHA256

    301fc095cca3f5f1f2449f39871b548cca14f795a556e8c63d319b91df90221f

    SHA512

    d2b32bdbbe3371db7bcd45d7e0ced6388bab6af5cc065e927de362ed2828c4aa82d1af28c4fedcbdf8b82beedfe0b8666b9bdec970cefe2a7133b0b7797adfda