flawedammyy | 5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Size

709KB
MD5

2104f66da494fb2cac8d654f02cd85d7
SHA1

98e44b9c65c15384da664d1b548e408b486e47bc
SHA256

5767921da620f5755d8ebb63c78fa3c2806003eede39253806813724e62f632a
SHA512

24cebfda8f1b90bc542f19d3c0ae8e7b51771c4e7e5b2fd2560dec1866b74f1172d85a6dbbf809a5f5bb9ecbac6a25db3477e8eec2fdb2d5f55fe4470b1555dc
SSDEEP

12288:J/VanOH+kAX8CrJpc4+9djmLfN971Rtc3MmylZDaehlJgJ:faOH+kbCr/c4+9hm7r1Rt4MmylZDV6J

Score

10^/10

flawedammyy discovery trojan

Malware Config

Signatures

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253c2f0e25d1c31b36b	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = d65beff4c905f9e5dc7c445dcc10cd1d3d18f62837118988fc0839b6b58d8744c95f33c75bf25929094777822e35004530a920eee7a6a9cc836a0e503f5bbd8d6a634a9941b1c4a73b672e	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2360	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2360	3432	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe	84
PID 3432 wrote to memory of 2360	3432	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe	84
PID 3432 wrote to memory of 2360	3432	JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3204

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2104f66da494fb2cac8d654f02cd85d7.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
be72bc6064728504f49f24f0189af980

SHA1
f47314ccf81cb77ea5ab34769553b3ca33aad2da

SHA256
c80d865e4f01ba181ed6db0a2a9b7f2338ecb0808c0c8210a3b426d3d72e4564

SHA512
0fd803aee612de870eb1288e25d0e95feea20e1c2635d7673eb27c34e1484cc15ceb0bc71f6602a8063900a43514e40914118765055f301443aa07d987903ad8

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
7b81d59f84d0dce59cc2b3ed806d9f38

SHA1
c649ade706d2d4460879952acbe16c1906df7e1c

SHA256
dcf60878be580e421db3001c9206bf540b229d64fad653a15afde5a910f0ef8f

SHA512
010dfda6895b0ecb24e577f61b704edcf5333dae3864bf7523947b9461287928a1a0c855fe1f841c123d39ee53ffb1ada823a432c68f2dc2414f87cfea9bf85f

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit