Analysis

  • max time kernel
    237s
  • max time network
    469s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 15:18

General

  • Target

    AnyDesk_x64x32/About/en-US/DWM.xml

  • Size

    4KB

  • MD5

    8c0c1f2ac3237b8aa71f88a5650c0e68

  • SHA1

    8a39fc535339841cc7573b1dcff729cec8e54114

  • SHA256

    844bf77e54e0c353537b0d1349f0173049dd36c0cb64eaee900663cd0a227ab4

  • SHA512

    c6f8ac395d011ec45ebf47812ebebf7e152db6a943566b744aa83b22529df07e3d0749d008b5f3a8a46953cccf39305966869e5efe502b1e727cf55ed7a05f4f

  • SSDEEP

    96:LeD5pm8i9yPYwH70day2JGkA5mZAOtfMtlV:E1i9Yn0zMA3G6

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\en-US\DWM.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:868 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1104

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\32TDQ684.txt
    Filesize

    601B

    MD5

    df8808c9a0a54824803a0772cae36ce1

    SHA1

    c79dbbaf7a3fa9c130258941dcfe76dd3304fb1a

    SHA256

    605695261514faf8605f1975d3040b029c6e018079ec55e2dae8b2c137aa4bec

    SHA512

    9a0c7ec60a60251b2448cea4af576475ba8757800d511468cd4c94568b2af5e0b706c47929bbae6931e8c3f829cca2f3d86a3b5b256dde66c1f6464210ecf658

  • memory/580-54-0x0000000075091000-0x0000000075093000-memory.dmp
    Filesize

    8KB