flawedammyy | 4731517b198414342891553881913565819509086b8154214462788c740b34c9

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AA_v3.exe
Size 726KB
Sample260718-gyctmsdw8x
SHA256 4731517b198414342891553881913565819509086b8154214462788c740b34c9
MD5 190785b2bb664324334c1b5231b5c4b0
SHA1 07539abb2623fe24b9a05e240f675fa2d15268cb
SHA512 ab40f182fb52e5281f0761cf064a7f4b82ea04a2c9c00fe6faa4e61f8e632b8c7a64820e226b2ab668c99ada195c1ca117b702474bd023d84991a16dd10ba85c
SSDEEP 12288:8YdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzagH:HdNikfu2hBfK8ilRty5olGJsxNH
TLSH
T18FF49D177981807FD1B60630899A6B75E9F6BE640E378A472388BE2C4D76E01DB1737C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery flawedammyy trojan

Malware Config

Signatures

Family: FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	AA_v3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087e665c5d4e1559534067554c3449b56b	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 2f6ef99d2741a4d57096cf8fbcd2ece1e088ed855010a6ba3e2580502f349dee30a3ae0c4030df0fd9575da8527e751510bee2a80fa32fc5093bd3ef642649061cf5662ef069c5511deb02	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AA_v3.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	4860	AA_v3.exe
Token: SeRestorePrivilege	4860	AA_v3.exe
Token: SeBackupPrivilege	4860	AA_v3.exe
Token: SeRestorePrivilege	4860	AA_v3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	AA_v3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4860	AA_v3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 4860	4336	AA_v3.exe	86

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3924

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
  "C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\ProgramData\AMMYY\hr
Size 22B
SHA256 e9702c02b0883505890b9c8dca38edefbb9046cc7c2fbb48dfb0c27f48f55631
MD5 b2b982a2c8ed3ec4af21e1710b61028f
SHA1 16c0f93066a5f150bfd58709510bcb2e7791f844
SHA512 094a3e6b9cdd3571dde901a5154e1e77040d45cfa5005d09265a6582e1fd36d09380459e09934cc1c41153777a059a69398a0a11a4438fa0dc733a99098a07db
MD5 SHA1 SHA512

Submit Download

hr3

Path C:\ProgramData\AMMYY\hr3
Size 75B
SHA256 e00d389f219c92043045cd76e04d901d71de868c7824e0bfbf6df380073c2224
MD5 4bfe1f7bb8dc25a0a191df117081b9e9
SHA1 129756899d3009b3dce56d999c704235eedcc71c
SHA512 d3c8325acf941015e777aa9b426b4e38b03b634dc8ce651c77254f2f36438220319f4a5d6162f025bad5f5ec099ea822c47b9abc75f7acd04a2f8945d3fe3467
TLSH
T144A022CF82008082A38028B8BAC00A0CEB38F83C00E2E02F0C8A3C00CA033C00A02CFC
MD5 SHA1 SHA512 TLSH

Submit Download

settings3.bin

Path C:\ProgramData\AMMYY\settings3.bin
Size 271B
SHA256 2658cd46dd49335e739cafa31ff2ec63f3315b65ecc171a0f7612713d3ac702b
MD5 4cb889e527b0d0781a17f6c2dd968129
SHA1 6a6a55cd5604370660f1c1ad1025195169be8978
SHA512 297d2c05d2ac950faeb519d3e7bc56ea9d9fcab65b5dfdbba2720be8eddc8b2d5ead3dc7c122b82d6937be6c2d7bb88872dd7b80961138571245fba381daac3f
TLSH
T171D0EBC40F6E26B20286308988C480BABB748BA6452780B31142082101C8C68232EC80
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads