Analysis
-
max time kernel
95s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
-
submitted
11-02-2023 00:15
General
-
Target
AnyDesk.exe
-
Size
3.8MB
-
MD5
e546506082b374a0869bdd97b313fe5d
-
SHA1
082dc6b336b41788391bad20b26f4b9a1ad724fc
-
SHA256
fc19f3275d02764cf249dc6fe8962e06b83a4f5769cc369bc4f77b90c567df18
-
SHA512
15a8d7c74193dffd77639b1356ccbe975d17de73d0d6d177b8ecf816d665f620adefcded37c141bac0b2d8564fbba61aca4d9b01885740f23fbcc190515cbd08
-
SSDEEP
98304:uSCb8xJlb0VgU/vZaZKa4opQILfbsLajDMWEeq7PbUs6En5:uH8HCOUZakpAbjbsLsMmqM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --frontend2⤵
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD58901494ccbafef92ae72ea8e379b5935
SHA10129c6d7bbf7252ab1d82127016872567cc38d53
SHA256711a72429babd5d6384400540c649a1eb4559c095df40c781b2de7e70573553d
SHA512b23516b949f94b03db97cac7072f8a91422365b50a3d2d951f8e6796868861a8742de5b4dd6e2c38c6ebecbd9f7612f841853ec72e6ef6d5bc1080252ac47a89
-
Filesize
7KB
MD58901494ccbafef92ae72ea8e379b5935
SHA10129c6d7bbf7252ab1d82127016872567cc38d53
SHA256711a72429babd5d6384400540c649a1eb4559c095df40c781b2de7e70573553d
SHA512b23516b949f94b03db97cac7072f8a91422365b50a3d2d951f8e6796868861a8742de5b4dd6e2c38c6ebecbd9f7612f841853ec72e6ef6d5bc1080252ac47a89
-
Filesize
27KB
MD5624d6cfabd000ba2bdaa4ac827bdc586
SHA1ae270ff434e60633926e49632a6ee2395fcc2c1a
SHA2567a02ffa16b8f4e7e208a9a4087debce94da3573b3abe858b5fa009a1670a82e0
SHA5120f404eb8bf14c9875970b47664a7c070683af29f319127e246a59213bd0cee510368576179c05c2635294d4d65cb3f0881923e472171fee98d7be481c55d70bd
-
Filesize
2KB
MD520f3f0251be9d82e5561257818793e9e
SHA1ada75da4949677166eb42e9d7545646e4cf740b0
SHA256c617b6f2a9e77865a7158284270a35db888ff73365a2f2210be86c53aa661cbf
SHA512073d12fb1ff90f420251805a2641fb253f7afbd02e7d9feb770a8d6bdaa898f70b96020863f1965f136e8eeb708967e33f2c022be533aec21bf3b5154e81eced
-
Filesize
2KB
MD5928ece7857aae66e4c0bf289387894ce
SHA10d7f2d8a600dca40dfd524baa438458db235d498
SHA256a4d5b6d8d5287d1df17f2043536b81578f2dd5130e2b5580345aee6474ab65bd
SHA512737fd515ed84f9312afea06ee8347c9715dfa2d7a19491911b30bf6d7432e9ee844df404fbaf6408d7e499a65f879daa7d01223aa0b8152096bc96c098bc87fe
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5361fcdefaee43eac47ab658ef280c85a
SHA18b5311573e1ae0b6c95ccea7991db6f985c60fcd
SHA2569696a52134297dbe6470834ad8d0a6aa611a2aba08c22865d4aef31018293065
SHA5122248e3c1c0aa110c441b5c910e9ce9846dfe8fa337c3339dc92c642f0274c5276a96e9f7c7b28aa61153d9202ec6e8c65e9013a01306dd82d2d26afa32129717
-
Filesize
611B
MD5ae86016e521bbb3e62648e6e61b98ac1
SHA11cddd46648841c75822fae7a84fadd07f87dd581
SHA256fc5956924f736982bf7bc14e553a403322ed77965022f73e54927fc199e69347
SHA512138c84217780adeb6484a0e33d610602f4d224d16fc5fa420c677f8b4ed894043e2628e94dd530b47b939e6ce296937298692d8d95c9598fc5671bd65154d526
-
Filesize
680B
MD5d13e3e15cc93fd192852915efbc7ed77
SHA14ab1bee786f45d1d49ee080ed9fc368e53ddbf4a
SHA256b77be9df0acd3c3657ed32e5c69ef08b5dcb9456053f7cc4ce958244884fcab0
SHA512b542ec4465f163cb695420488622027a3bfb7efbfd19bde96396b0834509ee7c207d9fc2bf3edca16c3ddfb5e70ff2c1abd8860b052915374e213d49cb4944b3
-
Filesize
848B
MD5092bbc82b114e31710cface8a4f19b6e
SHA165ae54ba39fb7994e274e0527c7ae1fd8526ebf5
SHA25647e89f9fc9b5271993a22d5b0031b822cde17869ce84b463dace10d39294cf5a
SHA51283857d3dd57be4fa77a8ed1608433c5943fe9d5d2ccf482a8640df517e98682c69bffae096fa3f2bd6aca1f78b610f1f96d056e82fc82bcd7d4d4fd4fda24824
-
Filesize
848B
MD5092bbc82b114e31710cface8a4f19b6e
SHA165ae54ba39fb7994e274e0527c7ae1fd8526ebf5
SHA25647e89f9fc9b5271993a22d5b0031b822cde17869ce84b463dace10d39294cf5a
SHA51283857d3dd57be4fa77a8ed1608433c5943fe9d5d2ccf482a8640df517e98682c69bffae096fa3f2bd6aca1f78b610f1f96d056e82fc82bcd7d4d4fd4fda24824
-
Filesize
848B
MD5092bbc82b114e31710cface8a4f19b6e
SHA165ae54ba39fb7994e274e0527c7ae1fd8526ebf5
SHA25647e89f9fc9b5271993a22d5b0031b822cde17869ce84b463dace10d39294cf5a
SHA51283857d3dd57be4fa77a8ed1608433c5943fe9d5d2ccf482a8640df517e98682c69bffae096fa3f2bd6aca1f78b610f1f96d056e82fc82bcd7d4d4fd4fda24824
-
Filesize
1KB
MD51e7db09ba7cd92923bfbc1c0aceab10c
SHA1911bd0a74e2fdef335891d06527164deca0e3950
SHA2566e2701ea103a663ab267ecae53a564af3f9adeefeb335aec92e2755c0bb6d296
SHA5121dba3e1e3901532f943c9d7ddca20f11caabe2b0d8781abef7e15da313c97c0e7722965fe1ad6993c9eac03023288aadc777c34cfea3ab4486861bb723bb9606
-
Filesize
1KB
MD5bb928ee699bd66a6dc481cdace205a1c
SHA13a2ed76199fe65bcd82250e065bd2c950d4fa7a1
SHA256536de889a266cec5bcbe449d97d547aed55d6cfa4295f8d1b226f7ae3f0574cd
SHA51230484d767833d80ebdbf8f7f321e3a0a6600a56a609d3ac67d048e2e615d91d559e0fbfd9d98966089e0d4e8db10210dedb35d1936561b3ee27a44d3fdaec501
-
Filesize
1KB
MD5bb928ee699bd66a6dc481cdace205a1c
SHA13a2ed76199fe65bcd82250e065bd2c950d4fa7a1
SHA256536de889a266cec5bcbe449d97d547aed55d6cfa4295f8d1b226f7ae3f0574cd
SHA51230484d767833d80ebdbf8f7f321e3a0a6600a56a609d3ac67d048e2e615d91d559e0fbfd9d98966089e0d4e8db10210dedb35d1936561b3ee27a44d3fdaec501
-
Filesize
1KB
MD5bb928ee699bd66a6dc481cdace205a1c
SHA13a2ed76199fe65bcd82250e065bd2c950d4fa7a1
SHA256536de889a266cec5bcbe449d97d547aed55d6cfa4295f8d1b226f7ae3f0574cd
SHA51230484d767833d80ebdbf8f7f321e3a0a6600a56a609d3ac67d048e2e615d91d559e0fbfd9d98966089e0d4e8db10210dedb35d1936561b3ee27a44d3fdaec501
-
Filesize
6KB
MD5a67357f2ad5e1ddd682a19b2d7c6c1ef
SHA164dcefce5d798aa0e163aa17f1ddd23c650fbfdf
SHA2563303ac2a7f838c327e2a587308b3e6846d56762605beed251727586ce401db9c
SHA512edc2c520073af2fa9106a9e523fe61a440c9b12e81eb09e7ffc1e0780e6a1224604d2ef8358ff4f1e9b5db31c77955029b99df2bcb5d0acac101d59d9497a58f
-
Filesize
6KB
MD5a67357f2ad5e1ddd682a19b2d7c6c1ef
SHA164dcefce5d798aa0e163aa17f1ddd23c650fbfdf
SHA2563303ac2a7f838c327e2a587308b3e6846d56762605beed251727586ce401db9c
SHA512edc2c520073af2fa9106a9e523fe61a440c9b12e81eb09e7ffc1e0780e6a1224604d2ef8358ff4f1e9b5db31c77955029b99df2bcb5d0acac101d59d9497a58f
-
Filesize
6KB
MD5a67357f2ad5e1ddd682a19b2d7c6c1ef
SHA164dcefce5d798aa0e163aa17f1ddd23c650fbfdf
SHA2563303ac2a7f838c327e2a587308b3e6846d56762605beed251727586ce401db9c
SHA512edc2c520073af2fa9106a9e523fe61a440c9b12e81eb09e7ffc1e0780e6a1224604d2ef8358ff4f1e9b5db31c77955029b99df2bcb5d0acac101d59d9497a58f
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
6KB
MD5eff6705d5f1ede6e49f69bf42371431c
SHA108db681b6783e14f64bf9b49a4135456723fab3e
SHA2562913d7437659ebc7af26952c9853138880ef96a188d0d150a42396b3d46faa1c
SHA5128f9ec86e88e459ae7fb8408fd3d5ddb94fab46b57a66b2ba65235f86c087910e329876218afa1e1887c86cbc985911e9385b2b3065c52718827f9dce286e13b4
-
Filesize
6KB
MD5c3789af23bba1d39fb5739e6da88fb91
SHA1410abb55ba349f528e173257bcd862e8d54451a5
SHA25689a90c6aee500b73eb3cbceca2ae96037a05eaa6386fbf3cd86318831c350619
SHA5127e50f2f067ca0e5597f80fee9e26959d8b745f94f7385fbf2a72b3521cd79888948a322439ba9e91832778b60b39e1b45c7e25ebf87ac75c06627062b4e1030e
-
Filesize
6KB
MD5c3789af23bba1d39fb5739e6da88fb91
SHA1410abb55ba349f528e173257bcd862e8d54451a5
SHA25689a90c6aee500b73eb3cbceca2ae96037a05eaa6386fbf3cd86318831c350619
SHA5127e50f2f067ca0e5597f80fee9e26959d8b745f94f7385fbf2a72b3521cd79888948a322439ba9e91832778b60b39e1b45c7e25ebf87ac75c06627062b4e1030e
-
Filesize
6KB
MD5f190664c9219b7912beb8d5fcd5e9f44
SHA1bc4e5aaa2776266d106b762d6f1731cb501294dd
SHA25674cf36b7c13cc4d7ccd3d8278505a3db70553e4d92884faa7768da98d74d34a5
SHA512f563977ba215067c250f2ecc47a73a952fda71d7c53439957ea57810c1608e52901664a8fa50c03b719140cfd8663dc90cb8b627dcb8a9fcec99a6c8a0b7552f
-
Filesize
3KB
MD515563dd01d837ea8214703d791b28c7e
SHA128e1c448c66b97ad1b55cb520ac63b730fb1ec34
SHA2564aaa4f15bff31c87f0746a9ca9ae959bd8aec41de0ddc4b603aaa5975f4a72a7
SHA51269ccf3e33fca6c57080abb5ac3eb089b56a8fa207e7b3b618f0b36c86082238c0cae06ac1003a65c9dda5460cb3b4859f676be34f0c7f1d51bbf00e1844c7d90
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.5MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
-
Filesize
16.5MB
-
Filesize
16.5MB
-
-
Filesize
16.5MB
-
-
Filesize
16.5MB