PUA.Win32.AmmyyAdmin.C
a variant of Win32/RemoteAdmin.Ammyy.B potentially unsafe application (NOD32)
Windows
Threat Type: Potentially Unwanted Application
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
769,535 bytes
EXE
Yes
08 Aug 2024
Arrival Details
This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Potentially Unwanted Application adds the following folders:
- %ProgramData%\AMMYY
(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)
It drops the following files:
- %ProgramData%\AMMYY\hr
- %ProgramData%\AMMYY\hr3
- %ProgramData%\AMMYY\settings3.bin
- {Malware Path}\{Malware Name}.log
(Note: %ProgramData% is a version of the Program Files folder where any user on a multi-user computer can make changes to programs. This contains application data for all users. This is usually C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit), or C:\Documents and Settings\All Users on Windows Server 2003(32-bit), 2000(32-bit) and XP.)
Other System Modifications
This Potentially Unwanted Application adds the following registry entries:
HKEY_CURRENT_USER\Software\Ammyy\
Admin
hr = {Random Hex}
HKEY_LOCAL_MACHINE\SOFTWARE\Ammyy\
Admin
hr = {Random Hex}
HKEY_CURRENT_USER\Software\Ammyy\
Admin
hr3 = {Random Hex}
HKEY_LOCAL_MACHINE\SOFTWARE\Ammyy\
Admin
hr3 = {Random Hex}
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AmmyyAdmin_52C
{Default} = Service
Other Details
This Potentially Unwanted Application adds the following registry keys:
HKEY_CURRENT_USER\Software\Ammyy
HKEY_LOCAL_MACHINE\SOFTWARE\Ammyy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Control\SafeBoot\Network\
AmmyyAdmin_52C
It connects to the following possibly malicious URL:
- http://{BLOCKED}yy.com/
- It uses the following routers that can be used to establish connections:
- {BLOCKED}.235:443,80,8080
- {BLOCKED}.242:443,80,8080
- {BLOCKED}.122:443,80,8080
It does the following:
- It uses remote desktop feature to facilitate remote access to another computer.
- It uses the following version of Ammyy Admin software:
- Ammyy Admin v3.5 - Free
- It allows establishing direct TCP connections.
- It allows users to specify external TCP ports.
- It allows the user to specify a TCP port to accept incoming connections by IP address.
- It allows users to select the audio playback and recording device to use during remote sessions.
- It can run under the SYSTEM account on Windows Vista, 7, 2003, or 2008.
- It allows the user to access files using the current user account's privileges.
- It allows users to customize the client-side experience of remote sessions with the following:
- Start "wait for session" mode automatically
- Show tooltip
- Disable desktop background
- Disable visual effects
- Disable desktop composition
- Access Permissions
- Video system speed test
- Path for accessing of File Manager
- It allows the user to establish persistency by creating the following service:
- Service name: AmmyyAdmin
Display name: AmmyyAdmin
Image Path: "{Malware Path}\{Malware Filename}" -service
- Service name: AmmyyAdmin
SOLUTION
9.800
2.755.00
22 Aug 2024
Step 1
Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Restart in Safe Mode, and then delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\AmmyyAdmin
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\Ammyy\Admin
- hr = {Random Hex}
- hr = {Random Hex}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Ammyy\Admin
- hr = {Random Hex}
- hr = {Random Hex}
- In HKEY_CURRENT_USER\Software\Ammyy\Admin
- hr3 = {Random Hex}
- hr3 = {Random Hex}
- In HKEY_LOCAL_MACHINE\SOFTWARE\Ammyy\Admin
- hr3 = {Random Hex}
- hr3 = {Random Hex}
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\AmmyyAdmin_52C
- {Default} = Service
- {Default} = Service
Step 5
Delete this registry key
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
- In HKEY_CURRENT_USER\Software\
- Ammyy
- Ammyy
- In HKEY_LOCAL_MACHINE\SOFTWARE\
- Ammyy
- Ammyy
- In HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\
- AmmyyAdmin_52C
- AmmyyAdmin_52C
Step 6
Search and delete these files
- %ProgramData%\AMMYY\hr
- %ProgramData%\AMMYY\hr3
- %ProgramData%\AMMYY\settings3.bin
- {Malware Path}\{Malware Name}.log
Step 7
Search and delete this folder
- %ProgramData%\AMMYY
Step 8
Restart in normal mode and scan your computer with your Trend Micro product for files detected as PUA.Win32.AmmyyAdmin.C. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.