flawedammyy | 4731517b198414342891553881913565819509086b8154214462788c740b34c9

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AA_v3.exe
Size 726KB
Sample260718-gyctmsdw8x
SHA256 4731517b198414342891553881913565819509086b8154214462788c740b34c9
MD5 190785b2bb664324334c1b5231b5c4b0
SHA1 07539abb2623fe24b9a05e240f675fa2d15268cb
SHA512 ab40f182fb52e5281f0761cf064a7f4b82ea04a2c9c00fe6faa4e61f8e632b8c7a64820e226b2ab668c99ada195c1ca117b702474bd023d84991a16dd10ba85c
SSDEEP 12288:8YdNctvsfu2LVBfKf057C9lRt3i5olGJsxhzagH:HdNikfu2hBfK8ilRty5olGJsxNH
TLSH
T18FF49D177981807FD1B60630899A6B75E9F6BE640E378A472388BE2C4D76E01DB1737C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery flawedammyy trojan

Malware Config

Signatures

Family: FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	AA_v3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	AA_v3.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA_v3.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr3 = 1a73924c81bb7f5411897713ac4fb146152ae1f734eaa9443939141fc5a076b04708b3feb59581e54a011c8de38c0879d3b57cbdbb4e853f8b40d5e34f7b430295b60a8527ab062bbb4b14	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	AA_v3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Ammyy\Admin	AA_v3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin	AA_v3.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Ammyy\Admin\hr = 537d567366087d675f5f4e18595301e14f5e3449b56b	AA_v3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4832	AA_v3.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4832	AA_v3.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 4832	796	AA_v3.exe	89

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:928

C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
"C:\Users\Admin\AppData\Local\Temp\AA_v3.exe" -service -lunch
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Local\Temp\AA_v3.exe
  "C:\Users\Admin\AppData\Local\Temp\AA_v3.exe"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\ProgramData\AMMYY\hr
Size 22B
SHA256 e9865ca343bc5b2db5ee837f401aca6c774756c4289743ac1739a35041e4adfc
MD5 104cbfba1e1a5e0d5aa1d5c9913b7e8d
SHA1 23a570aaa1527c4048cf9503cac35bce741ce204
SHA512 ad745402963f6ba1d022583718b02422bd697bf0ab1cea6b2b9bc9cff9500e91a7617a365512ac4bf48d321a0a56d0a34c819e09f67af6c4c8937c5ab2e3906a
MD5 SHA1 SHA512

Submit Download

hr3

Path C:\ProgramData\AMMYY\hr3
Size 75B
SHA256 3a6b7c18856d44966d411018a9d03f1b2b5912b162413a13c606afce829e27ef
MD5 cd5ed49e67b8cf044d36cc627b8bc7ea
SHA1 78feb62878b3beedab396d7cedee4cd181473deb
SHA512 5a8b25f605347622624f6d89b105cab60e4f66d11262a86aff8fa48206cf31a57bf92798e6105b99bbe67489d3d3fe91cc96e222cd6f43c9c21b0bccd4c8dcba
TLSH
T111A022CA820330AB88C2CC00A380388BE800E8FF00B0E000E00A0F208C2A20E8E38308
MD5 SHA1 SHA512 TLSH

Submit Download

settings3.bin

Path C:\ProgramData\AMMYY\settings3.bin
Size 271B
SHA256 2658cd46dd49335e739cafa31ff2ec63f3315b65ecc171a0f7612713d3ac702b
MD5 4cb889e527b0d0781a17f6c2dd968129
SHA1 6a6a55cd5604370660f1c1ad1025195169be8978
SHA512 297d2c05d2ac950faeb519d3e7bc56ea9d9fcab65b5dfdbba2720be8eddc8b2d5ead3dc7c122b82d6937be6c2d7bb88872dd7b80961138571245fba381daac3f
TLSH
T171D0EBC40F6E26B20286308988C480BABB748BA6452780B31142082101C8C68232EC80
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads