ammyyadmin | 34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5

General

Target

JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Size

322KB
MD5

fcc84b2913606db9ed575affe65591ae
SHA1

a6b6c3e28d245df70c307c354eab877e5fb8efd2
SHA256

34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5
SHA512

5e6f9b0040acea1dce8463bd30eb7905de215fd378d112a4d50dd80303539c38e1f516b7512297c215ae77050445785f994a96b7c8ea94a075ea340229b7e0c7
SSDEEP

6144:MtU6T/wE1MFGonDrJU2kY1b94hsmjVTPdgBGE7YpqTFIVo+AxU36WDbl3:aU+/wEKAonDrFyhtTR+YQTL+Axg

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 3 IoCs

resource	yara_rule
behavioral1/memory/2404-8-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral1/memory/2096-6-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral1/memory/2516-14-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Control Panel\International\Geo\Nation	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2096-4-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2404-8-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2096-6-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral1/memory/2516-14-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr = 537d567366087c6658524c175253d7bc8fa8bc20b36b	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin\hr3 = 1c8eb37739b5a2343e5da9edf466fe9f65e1c3cc6a3ccb03eff13d570592004e8719d5d0cc748dc08de99d0d661ab7d6ffdb0a405a0225c38ebcb0930f74c5873dd2fef8e4ef006008edbd	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2516	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2516	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2516	2096	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	31
PID 2096 wrote to memory of 2516	2096	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	31
PID 2096 wrote to memory of 2516	2096	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	31
PID 2096 wrote to memory of 2516	2096	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2404

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
96441e8ca6ae0e33dac5f71320375440

SHA1
57d517663a35a69ac4e431d3cb3cf476cbc52337

SHA256
d185eb37ebcb84fc800ff5ce84dc52235c443ac2339cd428d390cb785d7079a3

SHA512
83ce22099d5ff03437e8370473a3eeaea3c4e8eeb34c5a51bdf2be105b1d55d64c4f5df5e9c98b98c46ce40e1cd1edafa0a358325e6d72a63df17e3246f58edb

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
5912f3f10ec626f5b2b8ee2d1c838cd9

SHA1
b2bda00f129bd3f2ca06eee2655281a3b1169df5

SHA256
a89268b45e9295bc29f7f2e64963574e63684aa6a5f2eeada4803148cacfdcd5

SHA512
008f07cd93261ed09ecd5a0ead029b7be698cb0924a40610fe931f53b0ced4874aca752ec1ba6325baad2bb7e4d55176db106ab544aec8a4ad4dad776a9bc5c8

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/2096-4-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2096-6-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2404-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2404-8-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2516-14-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing