Overview
overview
10Static
static
7AnyDesk_x6...ot.xml
windows7-x64
1AnyDesk_x6...ot.xml
windows10-2004-x64
1AnyDesk_x6...ay.xml
windows7-x64
1AnyDesk_x6...ay.xml
windows10-2004-x64
1AnyDesk_x6...ls.xml
windows7-x64
1AnyDesk_x6...ls.xml
windows10-2004-x64
1AnyDesk_x6...sp.xml
windows7-x64
1AnyDesk_x6...sp.xml
windows10-2004-x64
1AnyDesk_x6...UI.xml
windows7-x64
1AnyDesk_x6...UI.xml
windows10-2004-x64
AnyDesk_x6...rs.xml
windows7-x64
1AnyDesk_x6...rs.xml
windows10-2004-x64
1AnyDesk_x6...el.xml
windows7-x64
1AnyDesk_x6...el.xml
windows10-2004-x64
1AnyDesk_x6...OM.xml
windows7-x64
1AnyDesk_x6...OM.xml
windows10-2004-x64
1AnyDesk_x6...FS.xml
windows7-x64
1AnyDesk_x6...FS.xml
windows10-2004-x64
1AnyDesk_x6...WM.xml
windows7-x64
1AnyDesk_x6...WM.xml
windows10-2004-x64
1AnyDesk_x6...32.exe
windows7-x64
10AnyDesk_x6...32.exe
windows10-2004-x64
Analysis
-
max time kernel
164s -
max time network
528s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 15:18
Behavioral task
behavioral1
Sample
AnyDesk_x64x32/About/ExternalBoot.xml
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AnyDesk_x64x32/About/ExternalBoot.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
AnyDesk_x64x32/About/en-US/ControlPanelDisplay.xml
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
AnyDesk_x64x32/About/en-US/ControlPanelDisplay.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
AnyDesk_x64x32/About/en-US/Cpls.xml
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
AnyDesk_x64x32/About/en-US/Cpls.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
AnyDesk_x64x32/About/en-US/CredSsp.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
AnyDesk_x64x32/About/en-US/CredSsp.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
AnyDesk_x64x32/About/en-US/CredUI.xml
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
AnyDesk_x64x32/About/en-US/CredUI.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
AnyDesk_x64x32/About/en-US/CtrlAltDel.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
AnyDesk_x64x32/About/en-US/CtrlAltDel.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
AnyDesk_x64x32/About/en-US/DCOM.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
AnyDesk_x64x32/About/en-US/DCOM.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
AnyDesk_x64x32/About/en-US/DFS.xml
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
AnyDesk_x64x32/About/en-US/DFS.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
AnyDesk_x64x32/About/en-US/DWM.xml
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
AnyDesk_x64x32/About/en-US/DWM.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
AnyDesk_x64x32/AnyDesk_x64x32.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
AnyDesk_x64x32/AnyDesk_x64x32.exe
Resource
win10v2004-20221111-en
General
-
Target
AnyDesk_x64x32/About/en-US/CredentialProviders.xml
-
Size
5KB
-
MD5
b735ff00bd6511f0525c74881042cfbf
-
SHA1
f9540a99e5654ea5f6b7aaf49ce35f591cec2863
-
SHA256
ff1b853b846ea63064ad460b42c44230de008297b6a2ddb8daa48991a5684c14
-
SHA512
a585ae89c4b13a6a2de50d414069fe40d3db53395a4e79b5865b530acc6963b2c89647d2735b27229503b58bac47b4c43b38e6e2beb00b81ec6f1d76db441c06
-
SSDEEP
96:LeD5pmAznn5XkKkcx1ftU6beY3rqFimzWSsdK/l+3yY8V:Ejznn5XkJcx1fdPrqFOXU/loyb
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "779843068" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000575" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "779843068" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000575" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{5664288B-73F2-11ED-919F-42A3CC74B480} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000575" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000575" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "832031545" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "832031545" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3200 iexplore.exe 3200 iexplore.exe 4296 IEXPLORE.EXE 4296 IEXPLORE.EXE 4296 IEXPLORE.EXE 4296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
MSOXMLED.EXEiexplore.exedescription pid process target process PID 3252 wrote to memory of 3200 3252 MSOXMLED.EXE iexplore.exe PID 3252 wrote to memory of 3200 3252 MSOXMLED.EXE iexplore.exe PID 3200 wrote to memory of 4296 3200 iexplore.exe IEXPLORE.EXE PID 3200 wrote to memory of 4296 3200 iexplore.exe IEXPLORE.EXE PID 3200 wrote to memory of 4296 3200 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\en-US\CredentialProviders.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\en-US\CredentialProviders.xml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3200 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3252-132-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-133-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-134-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-135-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-136-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-137-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-138-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-139-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB
-
memory/3252-140-0x00007FFC36B70000-0x00007FFC36B80000-memory.dmpFilesize
64KB