Overview
overview
10Static
static
7AnyDesk_x6...ot.xml
windows7-x64
1AnyDesk_x6...ot.xml
windows10-2004-x64
1AnyDesk_x6...ay.xml
windows7-x64
1AnyDesk_x6...ay.xml
windows10-2004-x64
1AnyDesk_x6...ls.xml
windows7-x64
1AnyDesk_x6...ls.xml
windows10-2004-x64
1AnyDesk_x6...sp.xml
windows7-x64
1AnyDesk_x6...sp.xml
windows10-2004-x64
1AnyDesk_x6...UI.xml
windows7-x64
1AnyDesk_x6...UI.xml
windows10-2004-x64
AnyDesk_x6...rs.xml
windows7-x64
1AnyDesk_x6...rs.xml
windows10-2004-x64
1AnyDesk_x6...el.xml
windows7-x64
1AnyDesk_x6...el.xml
windows10-2004-x64
1AnyDesk_x6...OM.xml
windows7-x64
1AnyDesk_x6...OM.xml
windows10-2004-x64
1AnyDesk_x6...FS.xml
windows7-x64
1AnyDesk_x6...FS.xml
windows10-2004-x64
1AnyDesk_x6...WM.xml
windows7-x64
1AnyDesk_x6...WM.xml
windows10-2004-x64
1AnyDesk_x6...32.exe
windows7-x64
10AnyDesk_x6...32.exe
windows10-2004-x64
Analysis
-
max time kernel
333s -
max time network
415s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 15:18
Behavioral task
behavioral1
Sample
AnyDesk_x64x32/About/ExternalBoot.xml
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AnyDesk_x64x32/About/ExternalBoot.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
AnyDesk_x64x32/About/en-US/ControlPanelDisplay.xml
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
AnyDesk_x64x32/About/en-US/ControlPanelDisplay.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
AnyDesk_x64x32/About/en-US/Cpls.xml
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
AnyDesk_x64x32/About/en-US/Cpls.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
AnyDesk_x64x32/About/en-US/CredSsp.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
AnyDesk_x64x32/About/en-US/CredSsp.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
AnyDesk_x64x32/About/en-US/CredUI.xml
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
AnyDesk_x64x32/About/en-US/CredUI.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
AnyDesk_x64x32/About/en-US/CtrlAltDel.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
AnyDesk_x64x32/About/en-US/CtrlAltDel.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
AnyDesk_x64x32/About/en-US/DCOM.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
AnyDesk_x64x32/About/en-US/DCOM.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
AnyDesk_x64x32/About/en-US/DFS.xml
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
AnyDesk_x64x32/About/en-US/DFS.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
AnyDesk_x64x32/About/en-US/DWM.xml
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
AnyDesk_x64x32/About/en-US/DWM.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
AnyDesk_x64x32/AnyDesk_x64x32.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
AnyDesk_x64x32/AnyDesk_x64x32.exe
Resource
win10v2004-20221111-en
General
-
Target
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
-
Size
5KB
-
MD5
b735ff00bd6511f0525c74881042cfbf
-
SHA1
f9540a99e5654ea5f6b7aaf49ce35f591cec2863
-
SHA256
ff1b853b846ea63064ad460b42c44230de008297b6a2ddb8daa48991a5684c14
-
SHA512
a585ae89c4b13a6a2de50d414069fe40d3db53395a4e79b5865b530acc6963b2c89647d2735b27229503b58bac47b4c43b38e6e2beb00b81ec6f1d76db441c06
-
SSDEEP
96:LeD5pmAznn5XkKkcx1ftU6beY3rqFimzWSsdK/l+3yY8V:Ejznn5XkJcx1fdPrqFOXU/loyb
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376936843" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000000419fe37cc0a1e98c07cd9e2a2384b56f541b24616ee6877b4fdce42e443dcd0000000000e8000000002000020000000de0f009f39cc648c0a994bd69246faeecdba7b974a5f075bf0645b1dc5c0b73620000000534b0f6b0ee5d371cbd0a2331077ca588b8b475b38a500d40b643c5665edecd940000000e63160ed7d1f8e73efde621ca985e48a5c0c022106d23183e5970f2ee9b110e760c06f0af1082b398e200b13c43f746856f062718b5acf65aa740910d338afa8 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAE24F71-73F1-11ED-8045-767CA9D977BF} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50eb21dffe07d901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000510e43b138d4b649d2f45d05c928aae5f7d13e8cc3cbe59a6093740dcd745ae1000000000e80000000020000200000005ac6ce1f33daa145b326f6550252b137c01f537db2761fd59248961645d2759c900000007abbd55131be2d79585326bc7e25b8aa44a81ee2a97bda3ec79348581dfa60cee34dce428f6385d6d9cc4ef51df9bae40c05d3ccda71ab67cc661a6d71f8bebd0aaa21433a47d941935ee982a919f886fb35dab651c366d4f8ec981ea8e88138a503c403d19b0173a724d9f9ad229dbefb6b89ad5cd5c233e447826c291617b0fc3c71c7eda42a90230397fab5d48e8f40000000e49b8f155db1e314f8dbfd9a6992d3be833f31efae918439ec77dec116250f3506bed8335903970dcc96de1bd8ad0b32d0dcbe68ce0cec551ffb62407298f188 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1516 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1516 IEXPLORE.EXE 1516 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1824 wrote to memory of 1712 1824 MSOXMLED.EXE iexplore.exe PID 1824 wrote to memory of 1712 1824 MSOXMLED.EXE iexplore.exe PID 1824 wrote to memory of 1712 1824 MSOXMLED.EXE iexplore.exe PID 1824 wrote to memory of 1712 1824 MSOXMLED.EXE iexplore.exe PID 1712 wrote to memory of 1516 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1516 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1516 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1516 1712 iexplore.exe IEXPLORE.EXE PID 1516 wrote to memory of 1376 1516 IEXPLORE.EXE IEXPLORE.EXE PID 1516 wrote to memory of 1376 1516 IEXPLORE.EXE IEXPLORE.EXE PID 1516 wrote to memory of 1376 1516 IEXPLORE.EXE IEXPLORE.EXE PID 1516 wrote to memory of 1376 1516 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\en-US\CredentialProviders.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NQ1YL38W.txtFilesize
533B
MD59effaa7b2aceb4c5a3a0b78472298e72
SHA1aa4cf80e3d4487f0143b71710be8ab149b817228
SHA2565fd07d313c22d09fa590172ca657d8fe0abe6c0291a3eb30feecae50d5564eb4
SHA5126a22134267597c434812475debd1bfe1a07e3115cd616b01c29279ed0858707ca1cfb54dbb69368ff5b3b626718b7ba4ec3cf37b92eb413b979963ec88f33939
-
memory/1824-54-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB