Analysis

  • max time kernel
    142s
  • max time network
    207s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 15:18

General

  • Target

    AnyDesk_x64x32/About/en-US/CredUI.xml

  • Size

    3KB

  • MD5

    1c00f0e54b646baca8571fc0b7be9582

  • SHA1

    0494d0849b95970d96e480c9b00c3694e4d50029

  • SHA256

    625371bba40530a9a4a88e167b4870634f7583bb601d16954ed8ff4a0e5242e9

  • SHA512

    99a2b51a6addf470b15dfdc2d3d32ca305113c427cdf7c3b85fd3bd43f17b989b5bea38ba78821da5a8978437dd3e484ccb283d9b01b737c05c4b7d82288d749

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\AnyDesk_x64x32\About\en-US\CredUI.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1460
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K1QW3EM2.txt
    Filesize

    537B

    MD5

    5223a03e8c28ffe69f34264a47ef75fa

    SHA1

    b0e444b3a21b94f9c48fb5c911ee2fd61835eddd

    SHA256

    111ce88760bd16fddd9985670b6fad60dbc83ff3e1b17518b28c4bf06762cc1a

    SHA512

    f71101103b55e8748aa8dd0960d774d4a884a454e7d3a44dd5562c914dc0f218e5e16e73744e56af9af49153fe179d56e213b03dc954dbcb12e5439a6d80935f

  • memory/2008-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp
    Filesize

    8KB