URL:

https://www.ammyy.com/AA_v3.php?v=280566151

Full analysis: https://app.any.run/tasks/fbd54d35-3b28-429b-9d26-155d97df0f59
Verdict: Malicious activity
Analysis date: September 05, 2023, 05:56:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
ammyy
remote
Indicators:
MD5:

FBB414B82D628AD9D90BF085F1AD4D26

SHA1:

3D7817989724CE8C07A0E78C205E86641B8DC55C

SHA256:

0536EE8AC10175229BA70FFF33F5CD88D42DEB5B4C0C1AA6190374AC42584989

SSDEEP:

3:N8DSLuGK3ITWTtQU:2OLuGzWj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AA_v3.exe (PID: 3024)
      • AA_v3.exe (PID: 2080)
      • AA_v3.exe (PID: 2468)
      • AA_v3.exe (PID: 3944)

    • Deletes the SafeBoot registry key

      • AA_v3.exe (PID: 2468)

    • AMMYY was detected

      • AA_v3.exe (PID: 2080)

    • Creates a writable file the system directory

      • AA_v3.exe (PID: 2080)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 1032)

  • SUSPICIOUS

    • Reads the Internet Settings

      • AA_v3.exe (PID: 3024)

    • Application launched itself

      • AA_v3.exe (PID: 3024)
      • AA_v3.exe (PID: 3944)

    • Executes as Windows Service

      • AA_v3.exe (PID: 3944)

    • Checks for external IP

      • AA_v3.exe (PID: 2080)

    • Executable content was dropped or overwritten

      • AA_v3.exe (PID: 2080)

    • Uses RUNDLL32.EXE to load library

      • AA_v3.exe (PID: 2080)

    • Checks Windows Trust Settings

      • AA_v3.exe (PID: 2080)

    • Adds/modifies Windows certificates

      • AA_v3.exe (PID: 3944)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3484)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2372)
      • iexplore.exe (PID: 3484)

    • Checks proxy server information

      • AA_v3.exe (PID: 3024)

    • The process uses the downloaded file

      • AA_v3.exe (PID: 3024)
      • iexplore.exe (PID: 3484)

    • Checks supported languages

      • AA_v3.exe (PID: 3024)
      • AA_v3.exe (PID: 3944)
      • AA_v3.exe (PID: 2468)
      • AA_v3.exe (PID: 2080)

    • Creates files in the program directory

      • AA_v3.exe (PID: 3024)
      • AA_v3.exe (PID: 2080)

    • Reads the computer name

      • AA_v3.exe (PID: 2468)
      • AA_v3.exe (PID: 3024)
      • AA_v3.exe (PID: 2080)
      • AA_v3.exe (PID: 3944)

    • Process checks computer location settings

      • AA_v3.exe (PID: 2080)

    • Reads the machine GUID from the registry

      • AA_v3.exe (PID: 2080)

    • Creates files or folders in the user directory

      • AA_v3.exe (PID: 2080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe aa_v3.exe no specs aa_v3.exe aa_v3.exe no specs #AMMYY aa_v3.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1032rundll32.exe "C:\ProgramData\AMMYY\aa_nts.dll",runC:\Windows\System32\rundll32.exe—AA_v3.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2080"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe" -elevated C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe
AA_v3.exe
User:
SYSTEM
Company:
Ammyy LLC
Integrity Level:
SYSTEM
Description:
Ammyy Admin
Exit code:
0
Version:
3.10
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\aa_v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2372"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3484 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2468"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe" -elevated C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe
AA_v3.exe
User:
admin
Company:
Ammyy LLC
Integrity Level:
HIGH
Description:
Ammyy Admin
Exit code:
0
Version:
3.10
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\aa_v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3024"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe—iexplore.exe
User:
admin
Company:
Ammyy LLC
Integrity Level:
MEDIUM
Description:
Ammyy Admin
Exit code:
0
Version:
3.10
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\aa_v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3484"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.ammyy.com/AA_v3.php?v=280566151"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3944"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe" -service -lunchC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\AA_v3.exe—services.exe
User:
SYSTEM
Company:
Ammyy LLC
Integrity Level:
SYSTEM
Description:
Ammyy Admin
Exit code:
0
Version:
3.10
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\aa_v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
24 006
Read events
23 896
Write events
105
Delete events
5

Modification events

(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
4
Suspicious files
29
Text files
41
Unknown types
0

Dropped files

PID
Process
Filename
Type
2372iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab8035.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:E311BDA85CA50E60B5894E5C8A6D118C
SHA256:742B26771C3627266FA2812C818B173C3A73C9FE455BD597630C5A0C0B7917BB
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:E54F09594635A9E0F9933E5F11F26EA9
SHA256:6794FE10B063C844075155B91A2F9994EF374C2CF2C79872AB60BA3CC583079A
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5037AC1E573F140500110A0B67548B5Eder
MD5:6F8FCCCCEFFAB1CD6CE74AC119DA52DE
SHA256:A1E96A3F1CEDDBB0BD6CE4EB5C3666AD2F59F8E51AC641D4AC288B2DB857D036
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\downloads[1].htmhtml
MD5:7E53FBDA60B21F46148B45078065FADF
SHA256:A9E3E2282763C2368C25C9EA8E39B21CE29697A3F019D60953971EE800E90034
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5037AC1E573F140500110A0B67548B5Ebinary
MD5:BB2FAA43EFC279EAF434769D7990C5B6
SHA256:CB24A23091B81E8F8C697D74CD133282AF963B66C872EFDE620C79694BC9BD9B
2372iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:E774A350375A8F84173444A03BC317B5
SHA256:5DD7727A1EB816E91C75612A2891EA0D0BC33E87133DCD97412641B4FB2D9659
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\downloads[1].htmhtml
MD5:161B1B711F7E20F0C7039882F967BC6E
SHA256:8F91E309BA79AEDD2BA121B91E7C72C51782C1E00B3D86A73CB25D9B46E649D4
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\top_l[1].gifimage
MD5:95F83C97085814168E7A0244CCC3D10B
SHA256:9FB95459CEFEFE39545D8D5AD8D63740EE5163B29238CFD2D541312717BF8472
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
55
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2372
iexplore.exe
GET
200
23.56.202.135:80
http://x1.c.lencr.org/
unknown
der
717 b
unknown
2372
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ae0c2afaac3e78ff
unknown
compressed
61.6 Kb
unknown
2372
iexplore.exe
GET
301
136.243.18.118:80
http://www.ammyy.com/en/downloads.html
unknown
html
325 b
unknown
2372
iexplore.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
der
1.41 Kb
unknown
2372
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?33d3eed36c4585a3
unknown
compressed
61.6 Kb
unknown
2080
AA_v3.exe
GET
200
184.24.77.79:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQ7v4J%2FgaqUqpyZN7zZz%2ByuYw%3D%3D
unknown
der
503 b
unknown
2372
iexplore.exe
GET
200
184.24.77.48:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQ7v4J%2FgaqUqpyZN7zZz%2ByuYw%3D%3D
unknown
der
503 b
unknown
2080
AA_v3.exe
GET
200
23.56.202.135:80
http://x1.c.lencr.org/
unknown
der
717 b
unknown
2372
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a1812858e79438c5
unknown
compressed
4.66 Kb
unknown
2080
AA_v3.exe
GET
301
136.243.18.118:80
http://www.ammyy.com/files/v7/aans32.gz
unknown
html
326 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2372
iexplore.exe
136.243.18.118:443
www.ammyy.com
Hetzner Online GmbH
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2372
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2372
iexplore.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
2372
iexplore.exe
184.24.77.48:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
2372
iexplore.exe
136.243.18.118:80
www.ammyy.com
Hetzner Online GmbH
DE
unknown
2372
iexplore.exe
142.250.186.72:443
ssl.google-analytics.com
GOOGLE
US
unknown
2372
iexplore.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3484
iexplore.exe
136.243.18.118:443
www.ammyy.com
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
www.ammyy.com
  • 136.243.18.118
malicious
ctldl.windowsupdate.com
  • 95.140.236.128
  • 178.79.242.0
whitelisted
x1.c.lencr.org
  • 23.56.202.135
whitelisted
r3.o.lencr.org
  • 184.24.77.48
  • 184.24.77.54
  • 184.24.77.79
shared
ssl.google-analytics.com
  • 142.250.186.72
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.123.104.34
  • 92.123.104.40
  • 92.123.104.8
  • 92.123.104.60
  • 92.123.104.28
  • 92.123.104.19
  • 92.123.104.11
  • 92.123.104.31
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
rl.ammyy.com
  • 188.42.129.148
suspicious

Threats

PID
Process
Class
Message
2080
AA_v3.exe
Potential Corporate Privacy Violation
ET POLICY IP Check (rl. ammyy. com)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.ammyy.com/AA_v3.php?v=280566151