Analysis

  • max time kernel
    127s
  • max time network
    221s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 15:18

General

  • Target

    AnyDesk_x64x32/About/en-US/DCOM.xml

  • Size

    4KB

  • MD5

    7df9e61d5f72660a48741a9d1ae6df2a

  • SHA1

    a623bd2021eaa8863519e110e2c4d141d68e6dee

  • SHA256

    bd0e69bf353115e23b4344875da15df78bd4adf676eeab35aed30a21c129ebed

  • SHA512

    726fc2bd5444e1791811c9f39b3b535d155aa0ba2ac8b50f7a8b6faf48e7bedbd542c96c701a1cd58b1c89b89da04d9c175e9ccde70da27c92e073e570138dd1

  • SSDEEP

    96:LeD5pmc4qzQuQ+kCO+QW9JvqIiErBAqHPkGitHqEJw2mL8ykL3/NBV:El4qE9+kCOtW9dqIiErBAgPk/tKEJw2D

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\en-US\DCOM.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1988
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\M5AAYPO5.txt
    Filesize

    537B

    MD5

    57581bf87c25adc04474f1fa46dad781

    SHA1

    e2480057d25ddfc69a96c5b58eb00dce84ebcefa

    SHA256

    82a67cd848925d3088ee979d3ed73faf4602088083857c57c53dbb9448bc4298

    SHA512

    d90c5133e0e01b69e3ef72cdcf5dff41616769492e724a4062f356e04157b22c9c0edc789b6849a1ccb8a3e53496e754a5c274299a070c01f3f6b9b65a5db9a7

  • memory/1704-54-0x0000000075451000-0x0000000075453000-memory.dmp
    Filesize

    8KB