ammyyadmin | 34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5

General

Target

JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Size

322KB
MD5

fcc84b2913606db9ed575affe65591ae
SHA1

a6b6c3e28d245df70c307c354eab877e5fb8efd2
SHA256

34ee9da62967a53c3bf97f9301aa9353a3b42e5bd40c3122b929e50e08d146c5
SHA512

5e6f9b0040acea1dce8463bd30eb7905de215fd378d112a4d50dd80303539c38e1f516b7512297c215ae77050445785f994a96b7c8ea94a075ea340229b7e0c7
SSDEEP

6144:MtU6T/wE1MFGonDrJU2kY1b94hsmjVTPdgBGE7YpqTFIVo+AxU36WDbl3:aU+/wEKAonDrFyhtTR+YQTL+Axg

Score

10^/10

ammyyadmin flawedammyy discovery rat trojan upx

Malware Config

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 3 IoCs

resource	yara_rule
behavioral2/memory/5072-4-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral2/memory/1960-7-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin
behavioral2/memory/936-12-0x0000000000400000-0x00000000004BE000-memory.dmp	family_ammyyadmin

Ammyyadmin family
ammyyadmin
FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy

Downloads MZ/PE file 1 IoCs

flow	pid	Process
44	1848	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1318997816-2171176372-1451785247-1000\Control Panel\International\Geo\Nation	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1960-0-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/5072-4-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/1960-7-0x0000000000400000-0x00000000004BE000-memory.dmp	upx
behavioral2/memory/936-12-0x0000000000400000-0x00000000004BE000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
624	MicrosoftEdgeUpdate.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087c6658524c175253ced273acbc20b36b	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = e3cce36fc6f8c60205543c567d07a4ab19a62f4465fc635f3a1d542e72adb53db29f90f9f777f60ef13229efb64199a1d693a998c870cbcecdeaeb9af363d3cbd3ce45258478bbc23ea00b	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
936	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
936	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 936	5072	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	87
PID 5072 wrote to memory of 936	5072	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	87
PID 5072 wrote to memory of 936	5072	JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe	87

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1960

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fcc84b2913606db9ed575affe65591ae.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:936

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0YxOEMzQTMtNkNDNS00MUQwLTg5RUEtRUIyRjZEQjYzM0UwfSIgdXNlcmlkPSJ7MUU3RjBDQTctMzVCMy00NEJELUE0NTQtMzQxNTBFODkzMDY2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODAxMjI2RDMtQjI5Ri00MzM5LUE1NTEtMEZCNTZDNUU1Q0MwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMzNzEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDE5Mjc1MzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0NzY2NDQyNTUwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AMMYY\hr

Filesize
22B

MD5
c6144a7898b7f1443ae020dba93cf60d

SHA1
e2d0098ddebfe1ff993edf7a1c38e73712230e8b

SHA256
ae69ce7abca5e5e183f0671f3ccd1aefb251e8c211a8cfe345d3bf44c596a7d2

SHA512
e36e7fda579af01434478cf9d0db633d7416aa7d70f731aaffc67bc73985e551bdeade001b783bbbfb794e5830d0c911ab99b924d3a4be8f3165a30bc9a23786

Download Submit
C:\ProgramData\AMMYY\hr3

Filesize
75B

MD5
affd1494769eb7204de3bfddff17c43a

SHA1
6a7402d6797bfbecf6350555f1dd4ed352ec7b19

SHA256
8f6a68b69acfcbb122232e77cee841d2e5cea47636e092f63ea469d098ac8a40

SHA512
8ab0c6b37080b97326b700eb8ec80869d0eb916ec87aa6e02af57aac9f2454d373f9dbe409109c1ab492038e32bcfd8e030d11f9148e12279699af2b50dd315e

Download Submit
C:\ProgramData\AMMYY\settings3.bin

Filesize
269B

MD5
097a18ed7b31114c7ef39ef06eff02f0

SHA1
276bb5fc8ab72ed3a447dd57be668ace8f75a7c1

SHA256
985b458559939244b777d09d71d6192a13f693b88b046ca904012603a5582812

SHA512
168ef05ddb434dd4003748c7cd6ea9ed5c8280506de4473c3b193fffc314b469e85e2474f919f189c9b7ffb16aa741d75900341a9802dae175ad185e1fea3e96

Download Submit
memory/936-12-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1960-0-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1960-7-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/5072-4-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download

Analysis

Sharing