Overview
overview
10Static
static
7AnyDesk_x6...ot.xml
windows7-x64
1AnyDesk_x6...ot.xml
windows10-2004-x64
1AnyDesk_x6...ay.xml
windows7-x64
1AnyDesk_x6...ay.xml
windows10-2004-x64
1AnyDesk_x6...ls.xml
windows7-x64
1AnyDesk_x6...ls.xml
windows10-2004-x64
1AnyDesk_x6...sp.xml
windows7-x64
1AnyDesk_x6...sp.xml
windows10-2004-x64
1AnyDesk_x6...UI.xml
windows7-x64
1AnyDesk_x6...UI.xml
windows10-2004-x64
AnyDesk_x6...rs.xml
windows7-x64
1AnyDesk_x6...rs.xml
windows10-2004-x64
1AnyDesk_x6...el.xml
windows7-x64
1AnyDesk_x6...el.xml
windows10-2004-x64
1AnyDesk_x6...OM.xml
windows7-x64
1AnyDesk_x6...OM.xml
windows10-2004-x64
1AnyDesk_x6...FS.xml
windows7-x64
1AnyDesk_x6...FS.xml
windows10-2004-x64
1AnyDesk_x6...WM.xml
windows7-x64
1AnyDesk_x6...WM.xml
windows10-2004-x64
1AnyDesk_x6...32.exe
windows7-x64
10AnyDesk_x6...32.exe
windows10-2004-x64
Analysis
-
max time kernel
381s -
max time network
433s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 15:18
Behavioral task
behavioral1
Sample
AnyDesk_x64x32/About/ExternalBoot.xml
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AnyDesk_x64x32/About/ExternalBoot.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
AnyDesk_x64x32/About/en-US/ControlPanelDisplay.xml
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
AnyDesk_x64x32/About/en-US/ControlPanelDisplay.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
AnyDesk_x64x32/About/en-US/Cpls.xml
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
AnyDesk_x64x32/About/en-US/Cpls.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
AnyDesk_x64x32/About/en-US/CredSsp.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
AnyDesk_x64x32/About/en-US/CredSsp.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
AnyDesk_x64x32/About/en-US/CredUI.xml
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
AnyDesk_x64x32/About/en-US/CredUI.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
AnyDesk_x64x32/About/en-US/CtrlAltDel.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
AnyDesk_x64x32/About/en-US/CtrlAltDel.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
AnyDesk_x64x32/About/en-US/DCOM.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
AnyDesk_x64x32/About/en-US/DCOM.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
AnyDesk_x64x32/About/en-US/DFS.xml
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
AnyDesk_x64x32/About/en-US/DFS.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
AnyDesk_x64x32/About/en-US/DWM.xml
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
AnyDesk_x64x32/About/en-US/DWM.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
AnyDesk_x64x32/AnyDesk_x64x32.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
AnyDesk_x64x32/AnyDesk_x64x32.exe
Resource
win10v2004-20221111-en
General
-
Target
AnyDesk_x64x32/About/ExternalBoot.xml
-
Size
2KB
-
MD5
ada14c9e12ebb088628c86ada31184e6
-
SHA1
a2578366538e3de9ea2c047372217a3ff3ff25fb
-
SHA256
4bd2d8e664271482adfdb53411298577d2bb7c5cf18a6fff30fd8f40abb17ff4
-
SHA512
147a0d77b2c8e66a97d22e62d15248fc93c0a82d8529628a9612c7aac7dc48ccb3ca8fda317ccc0372e0c9001e8cdf8fa8d12e47d84412df3ddee0b1bebbd93f
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000009beff7e6f13674fc040bb83a19e2a5f996018fa1cc074c7309f3bef801d98862000000000e80000000020000200000005cbfd6c5ec1560a13f94461d6439ea9498e5adb499bb99cf2de6b4f1f6eefc1c2000000056850a177727cdfc8e8df301acc826b4f5b82fdc02e00e19da9168e188041a7040000000c827614c8b75ad1bfefdbdd77d1c295f6a7f38014e7489da509987d657921c1b62b95bfa0fd9f8b0c0abd2d49c809929c0b7d1cd387161d8db39546962a299ca IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000009e6e3ef5cac2c9957ef2221ec43be2fc33d5ad67cecec062993cb98cae479ee8000000000e8000000002000020000000e93c087e1e887ea5b5443133df55596c9d702187029f5ad9b252110ea5f985bd9000000030d89cf3d080f393f8b541fd2dcdbc11e45160d4645ed4531e92eac886f84d349ecc8d07ee99f6f4552dee56653884f81f6b1ce05b198a447ad0e6efb3535a79761d72880ee8dc599eff4148be59251a0c29f104ac4beeea887f5ab3db00810ec9f16d5547acf87724bca37dbe54639933756c3be60d982105f488f4c6139ff8c9bacb33c7238cd11750b683496f01f940000000e3db65485057c6831abfde3bd011d702e0bbf41b7cd7876057432c227615a885875db5aa0a818506620dc5f5588b3b9313489074a010cedd1f66a09c378fcd3e IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376936825" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECB1C7E1-73F1-11ED-ABF5-56A236AC5043} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c019bcddfe07d901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 772 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 772 IEXPLORE.EXE 772 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1700 wrote to memory of 1812 1700 MSOXMLED.EXE iexplore.exe PID 1700 wrote to memory of 1812 1700 MSOXMLED.EXE iexplore.exe PID 1700 wrote to memory of 1812 1700 MSOXMLED.EXE iexplore.exe PID 1700 wrote to memory of 1812 1700 MSOXMLED.EXE iexplore.exe PID 1812 wrote to memory of 772 1812 iexplore.exe IEXPLORE.EXE PID 1812 wrote to memory of 772 1812 iexplore.exe IEXPLORE.EXE PID 1812 wrote to memory of 772 1812 iexplore.exe IEXPLORE.EXE PID 1812 wrote to memory of 772 1812 iexplore.exe IEXPLORE.EXE PID 772 wrote to memory of 1704 772 IEXPLORE.EXE IEXPLORE.EXE PID 772 wrote to memory of 1704 772 IEXPLORE.EXE IEXPLORE.EXE PID 772 wrote to memory of 1704 772 IEXPLORE.EXE IEXPLORE.EXE PID 772 wrote to memory of 1704 772 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\ExternalBoot.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:772 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\41DETMW4.txtFilesize
533B
MD5ba256d369842ebe3b2717a3516aaba13
SHA1ec7069822d105a7079d0a5e676bcd7f2592acbcb
SHA256cc06533b726f90cdac9799fa15293902e62f069d738b3990590532d9ddfeb972
SHA51226933f585a23ff8ca2531f1d4e8700abc93689cec2565fd9c72835deb1f55304a7203c122c4bd5bcbd925bfe771c3802bf877dd535c51807f17f0085d962c490
-
memory/1700-54-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB