Analysis
-
max time kernel
54s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-09-2022 14:38
Static task
static1
Behavioral task
behavioral1
Sample
anydesk setup.msi
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
anydesk setup.msi
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
anydesk setup.msi
-
Size
8.2MB
-
MD5
1491e78be7e5a4c5a0475c7c679d1628
-
SHA1
d591dfa1bc1fce94018be12b0c45627d053406ca
-
SHA256
49e0e5f0de62fb6647ac6a76a8e57a9b636c777f9304337bff11971a7c6966e3
-
SHA512
cd0e0f4082fe2cba3e6719776f0ba0663f3c969950edcff118b03fa30f38fde278f80063f207b8cc2f0c4607a2a976e826fdbec165ab3aadafa1a76a25e3c243
-
SSDEEP
196608:EsmqQDx19HKjYh8EFwIR8j9IR8fsNHKSEv7c:EsmqQdqdIR85IRxNqS8c
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1156 MSIA27A.tmp 2024 MSIA27A.tmp -
Loads dropped DLL 1 IoCs
pid Process 1156 MSIA27A.tmp -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: msiexec.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA27A.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\6c9efe.msi msiexec.exe File created C:\Windows\Installer\6c9f00.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIA1AD.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\6c9efe.msi msiexec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1408 msiexec.exe 1408 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 57 IoCs
description pid Process Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe Token: SeSecurityPrivilege 1408 msiexec.exe Token: SeCreateTokenPrivilege 1284 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1284 msiexec.exe Token: SeLockMemoryPrivilege 1284 msiexec.exe Token: SeIncreaseQuotaPrivilege 1284 msiexec.exe Token: SeMachineAccountPrivilege 1284 msiexec.exe Token: SeTcbPrivilege 1284 msiexec.exe Token: SeSecurityPrivilege 1284 msiexec.exe Token: SeTakeOwnershipPrivilege 1284 msiexec.exe Token: SeLoadDriverPrivilege 1284 msiexec.exe Token: SeSystemProfilePrivilege 1284 msiexec.exe Token: SeSystemtimePrivilege 1284 msiexec.exe Token: SeProfSingleProcessPrivilege 1284 msiexec.exe Token: SeIncBasePriorityPrivilege 1284 msiexec.exe Token: SeCreatePagefilePrivilege 1284 msiexec.exe Token: SeCreatePermanentPrivilege 1284 msiexec.exe Token: SeBackupPrivilege 1284 msiexec.exe Token: SeRestorePrivilege 1284 msiexec.exe Token: SeShutdownPrivilege 1284 msiexec.exe Token: SeDebugPrivilege 1284 msiexec.exe Token: SeAuditPrivilege 1284 msiexec.exe Token: SeSystemEnvironmentPrivilege 1284 msiexec.exe Token: SeChangeNotifyPrivilege 1284 msiexec.exe Token: SeRemoteShutdownPrivilege 1284 msiexec.exe Token: SeUndockPrivilege 1284 msiexec.exe Token: SeSyncAgentPrivilege 1284 msiexec.exe Token: SeEnableDelegationPrivilege 1284 msiexec.exe Token: SeManageVolumePrivilege 1284 msiexec.exe Token: SeImpersonatePrivilege 1284 msiexec.exe Token: SeCreateGlobalPrivilege 1284 msiexec.exe Token: SeBackupPrivilege 268 vssvc.exe Token: SeRestorePrivilege 268 vssvc.exe Token: SeAuditPrivilege 268 vssvc.exe Token: SeBackupPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1800 DrvInst.exe Token: SeLoadDriverPrivilege 1800 DrvInst.exe Token: SeLoadDriverPrivilege 1800 DrvInst.exe Token: SeLoadDriverPrivilege 1800 DrvInst.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe Token: SeRestorePrivilege 1408 msiexec.exe Token: SeTakeOwnershipPrivilege 1408 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1408 wrote to memory of 1156 1408 msiexec.exe 31 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32 PID 1156 wrote to memory of 2024 1156 MSIA27A.tmp 32
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\anydesk setup.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1284
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\Installer\MSIA27A.tmp"C:\Windows\Installer\MSIA27A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\is-0MLS4.tmp\MSIA27A.tmp"C:\Users\Admin\AppData\Local\Temp\is-0MLS4.tmp\MSIA27A.tmp" /SL5="$1015A,7703614,831488,C:\Windows\Installer\MSIA27A.tmp"3⤵
- Executes dropped EXE
PID:2024
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:268
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004D4" "0000000000000494"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5f380cb51b5d8198c0f31f717949c4f00
SHA1088fd106ee395bb75a2ade6e51d21bd2faf63f51
SHA2562aae78bb1eff723a663d54be4973cad7a99ffece60d40524d9dbfac17694c455
SHA51272a8de30962014c78dca691cabc848705af53db452150bc3f7fdfe3a8e1db504b03bb6a6b5fe74d6a9719efd792ce69e839d936bd2918616598ea4b2295b3dd9
-
Filesize
8.1MB
MD5591e2cb28ab4c2c8729b7b8b21797779
SHA10708d8bade5e1c1e4198b440f988c1b1b722c1e6
SHA25687e0e6a8898d0d8043aec584b4a563943e539a5e7f3cadd78264dec1096f67f7
SHA51208e1ba57ae8364f16c6129a08ee6fcf7380aff036f8946601ab2311143227ef8a10a2057d8eff92e971ddd0006c3dbdeffbeb84bcf2d118228a9859e57186ae4
-
Filesize
8.1MB
MD5591e2cb28ab4c2c8729b7b8b21797779
SHA10708d8bade5e1c1e4198b440f988c1b1b722c1e6
SHA25687e0e6a8898d0d8043aec584b4a563943e539a5e7f3cadd78264dec1096f67f7
SHA51208e1ba57ae8364f16c6129a08ee6fcf7380aff036f8946601ab2311143227ef8a10a2057d8eff92e971ddd0006c3dbdeffbeb84bcf2d118228a9859e57186ae4
-
Filesize
3.0MB
MD5f380cb51b5d8198c0f31f717949c4f00
SHA1088fd106ee395bb75a2ade6e51d21bd2faf63f51
SHA2562aae78bb1eff723a663d54be4973cad7a99ffece60d40524d9dbfac17694c455
SHA51272a8de30962014c78dca691cabc848705af53db452150bc3f7fdfe3a8e1db504b03bb6a6b5fe74d6a9719efd792ce69e839d936bd2918616598ea4b2295b3dd9