Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
27-02-2023 23:42
General
-
Target
AnyDesk (1).exe
-
Size
3.8MB
-
MD5
e546506082b374a0869bdd97b313fe5d
-
SHA1
082dc6b336b41788391bad20b26f4b9a1ad724fc
-
SHA256
fc19f3275d02764cf249dc6fe8962e06b83a4f5769cc369bc4f77b90c567df18
-
SHA512
15a8d7c74193dffd77639b1356ccbe975d17de73d0d6d177b8ecf816d665f620adefcded37c141bac0b2d8564fbba61aca4d9b01885740f23fbcc190515cbd08
-
SSDEEP
98304:uSCb8xJlb0VgU/vZaZKa4opQILfbsLajDMWEeq7PbUs6En5:uH8HCOUZakpAbjbsLsMmqM
Malware Config
Signatures
-
Drops file in System32 directory 15 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-control2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (1).exe" --backend3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4ac 0x33c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
-
Filesize
5KB
MD5c269c05b49e32fdb94bf72159f178862
SHA1daddd284ad9fe6009aea9071e806eb3819f51cbb
SHA2567a0b9747c1c8be6989a43e3e24e21625974f9fd27b2377820ea3eff689a7a0c4
SHA512e4d6595bb02ed2f683488400317f8b4001f30b083b328277e46b210f366def138192b9e85874e2b3dbf13b69d500502b28ae218bcc7a84a7c0dd15cd1ddb60c9
-
Filesize
7KB
MD5babbeb1a74e8bab9f91e6a60194066f8
SHA1e9c09d6be30d41bee678decebee946fb62ab960d
SHA256ac75c0053e04a0d1ec1465e4a95f501d1baedeb586ecd2497c9cfdbb8d0e2a47
SHA51247f1a210ce1a8938e6060313ed0d5baa48440bd7ac348ef14b734700a1b4fcff2cb7421dc94700c236421469b0cb63e5834fff9f119bded53a5b43d594e5dedd
-
Filesize
38KB
MD52c41d89e301ece2465ad66f5fb549f05
SHA15fbe80152d353eb528263f34452df1cb0bb66b88
SHA256c161ee91eff894653c026dee6feff48be094d899c21b8430648c578cc6df98c2
SHA512d4104685bca97bfb4a7a9b4b7d74f927ef2b7aac66994417f52847043e9bb0844e094002ffa87dc73c33b71fcb9a8d78dfce33c9b850a57c3d326879c7e838da
-
Filesize
2KB
MD5abe15073a297f9aa2e317be57122f4c2
SHA1ed134c79282052f873aabe63d871f189d3b17f3c
SHA256254577612cc3bf2c16871cb08e02a2efbaabbf1ea5fbe0d758377ab50bca1587
SHA512bf5ebf9cb7fcbfbde7bce21e57e423c3194130ffcf0a221a46ad85570d937b7dda13fd8df1ec8b4b60f3e2249c7fd280702fb2bf455aaa815d6621a08817eff0
-
Filesize
2KB
MD5abe15073a297f9aa2e317be57122f4c2
SHA1ed134c79282052f873aabe63d871f189d3b17f3c
SHA256254577612cc3bf2c16871cb08e02a2efbaabbf1ea5fbe0d758377ab50bca1587
SHA512bf5ebf9cb7fcbfbde7bce21e57e423c3194130ffcf0a221a46ad85570d937b7dda13fd8df1ec8b4b60f3e2249c7fd280702fb2bf455aaa815d6621a08817eff0
-
Filesize
2KB
MD5ab1d1438704312f656a6d2df13d72c8e
SHA12abea1bef3d898ecc1436ba34cfcd52bbf5655e2
SHA256f2181332b0fee9c9e2d3a216e565374419e0bca34cdf2a15d82c072fc049eed9
SHA51285470da6b2094334e95461a29f258e368062b546adf247b0e397c81707630f3e5202b1586996d827bc5c34e945d20e1cdae79d48643b41b4fd6cc2f504b20b68
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5baa2e5afb996f194bd8dbc845dc41622
SHA1296d91bd13b3ab1a02480977dd422bc6090e5c5c
SHA256ca858f91c4ea6b51c1edfea19ee39147183e7b7704e0f2e5fb7d7c745163f7c0
SHA51237871423ce3d45f351716c5b7379c072644706c8f4010575b188a17a882ad1e28c14714cff2a76243701ae47869e3848b38a0664e91097fd7c72b596c3d717b9
-
Filesize
424B
MD514b53ed58f2a36f470adc4aa5d7e42ce
SHA1fe001f3c6445b4752511b0180cfc9c68da0d0a94
SHA256871720efb9cff4ac0f47675a08f60a6373368e3554cb3c3cfb4fd671c77797a2
SHA512ad832db668a1cb150c5b8bfe305a56fbf5387e6ae4907b6cc120062d20a10725c269a9f568a252b6cf56d3418274349a34f67bddd893bcdbfce66cb27fdd1fab
-
Filesize
424B
MD514b53ed58f2a36f470adc4aa5d7e42ce
SHA1fe001f3c6445b4752511b0180cfc9c68da0d0a94
SHA256871720efb9cff4ac0f47675a08f60a6373368e3554cb3c3cfb4fd671c77797a2
SHA512ad832db668a1cb150c5b8bfe305a56fbf5387e6ae4907b6cc120062d20a10725c269a9f568a252b6cf56d3418274349a34f67bddd893bcdbfce66cb27fdd1fab
-
Filesize
611B
MD5193c1a3e928c1001567548b5ae9a7e20
SHA19bf5ca58c404f21ff13e5fc4ac2093a763ef6785
SHA2567ecff2dc0356b779fd5e505f52a04421d287695c6cd53876ecd120b6231031d0
SHA5128f35ff680b0637fe0b244f1e8ea21125c3e06f1330840bd80c8ec06b43d5319413d9a7d5642c33efa595d731f580160e3d274f7a5ef9d6c2340663398f5abb2e
-
Filesize
611B
MD5193c1a3e928c1001567548b5ae9a7e20
SHA19bf5ca58c404f21ff13e5fc4ac2093a763ef6785
SHA2567ecff2dc0356b779fd5e505f52a04421d287695c6cd53876ecd120b6231031d0
SHA5128f35ff680b0637fe0b244f1e8ea21125c3e06f1330840bd80c8ec06b43d5319413d9a7d5642c33efa595d731f580160e3d274f7a5ef9d6c2340663398f5abb2e
-
Filesize
732B
MD56273b3a893d3004b044ef9b063740d3d
SHA174252d003ed60a9e5e2b40330e30bcd6094c3d0d
SHA25649acd3715179a0fa5afce6b88ba438e4dbc3478234ba22d743cb5cf5997063ea
SHA512853b6f57ee02b3f3eeed7d413a39256dc3cd1e1a222307797912ff77763b5bdf3f84c94df6d4e8b2533761a5d8699283ebe2ac9384aebbe9a2f3347d637690b2
-
Filesize
801B
MD57f47425e2dce294a6faa38607db3b62a
SHA1109ef160be474c5147a90ec41f0f845335bf5413
SHA25667273e350c1e66b11cb1ac92c7b5fca79318c5af724f1e1a68a7b8506c657d71
SHA5120f98db509968201ec2dffaa187063190e3ec5128050964158c0bf24990b40d1a66756ca03ded7cab7ee3dc16c3fea3e90917677fcfbca82a1afae0ff2cc58dde
-
Filesize
848B
MD5206ea150806d2fa4a7bbd4281542f3a1
SHA19bbc3e670687cca97fe6d7a6d8bcff4fadbdc59f
SHA25615b4678ffd6225e3e69418ce00387bd506b0140696ce8802d04172565b4dcea3
SHA512955e28f4e0ea9580d70977af032077ea5fb677ff57af048ce4875521cfbad03aee314647c52a5599f9260c1f813ce8e34d0bf2027e4d4db6cf7c2298f73acc9f
-
Filesize
848B
MD5206ea150806d2fa4a7bbd4281542f3a1
SHA19bbc3e670687cca97fe6d7a6d8bcff4fadbdc59f
SHA25615b4678ffd6225e3e69418ce00387bd506b0140696ce8802d04172565b4dcea3
SHA512955e28f4e0ea9580d70977af032077ea5fb677ff57af048ce4875521cfbad03aee314647c52a5599f9260c1f813ce8e34d0bf2027e4d4db6cf7c2298f73acc9f
-
Filesize
1KB
MD5a52f4d37d701ca7345ceabdbb3875ad7
SHA179defccebee2898816952d193a97857592ca0cac
SHA256aedc768da3e96818cb40145913caa0ce12830265e4295363abeb1627d203897d
SHA512c802c1808786ae3f50c03d1ff8ca3d59b88f25411e32ed204a7c8590b8375543f2efb6d0c1902502dc644f98b1336bd31e975bf7ed14631dffc9b24764a4b424
-
Filesize
1KB
MD5a52f4d37d701ca7345ceabdbb3875ad7
SHA179defccebee2898816952d193a97857592ca0cac
SHA256aedc768da3e96818cb40145913caa0ce12830265e4295363abeb1627d203897d
SHA512c802c1808786ae3f50c03d1ff8ca3d59b88f25411e32ed204a7c8590b8375543f2efb6d0c1902502dc644f98b1336bd31e975bf7ed14631dffc9b24764a4b424
-
Filesize
1KB
MD57b642ea7f71cdc1ba8b3a52d01c25f45
SHA14e2dc369755abe2802a77c84a0ab33d9c76d34c8
SHA2561842ea88209bcaa6ca64c9d062046b53c18ded15b747b3d6ef7a60044a283fec
SHA5120d066bc16afde7cc1e3f8660d8b278a72fdfdcd54c0adaa1c4eb0cd49b2af56acaaed9f95725f0bc9c22724b6e22904195dd68b9ccc98f10baaabb1101a19ab2
-
Filesize
1KB
MD57b642ea7f71cdc1ba8b3a52d01c25f45
SHA14e2dc369755abe2802a77c84a0ab33d9c76d34c8
SHA2561842ea88209bcaa6ca64c9d062046b53c18ded15b747b3d6ef7a60044a283fec
SHA5120d066bc16afde7cc1e3f8660d8b278a72fdfdcd54c0adaa1c4eb0cd49b2af56acaaed9f95725f0bc9c22724b6e22904195dd68b9ccc98f10baaabb1101a19ab2
-
Filesize
1KB
MD57b642ea7f71cdc1ba8b3a52d01c25f45
SHA14e2dc369755abe2802a77c84a0ab33d9c76d34c8
SHA2561842ea88209bcaa6ca64c9d062046b53c18ded15b747b3d6ef7a60044a283fec
SHA5120d066bc16afde7cc1e3f8660d8b278a72fdfdcd54c0adaa1c4eb0cd49b2af56acaaed9f95725f0bc9c22724b6e22904195dd68b9ccc98f10baaabb1101a19ab2
-
Filesize
1KB
MD57b642ea7f71cdc1ba8b3a52d01c25f45
SHA14e2dc369755abe2802a77c84a0ab33d9c76d34c8
SHA2561842ea88209bcaa6ca64c9d062046b53c18ded15b747b3d6ef7a60044a283fec
SHA5120d066bc16afde7cc1e3f8660d8b278a72fdfdcd54c0adaa1c4eb0cd49b2af56acaaed9f95725f0bc9c22724b6e22904195dd68b9ccc98f10baaabb1101a19ab2
-
Filesize
5KB
MD5fd4e133822693eb52e598394883bc5d3
SHA187b510491c4d7f40cfdd9bc9fabb285911c8cd6a
SHA2566696aca0062d3b9c0a4477d7d921e20648a563871f0cb9bbffd04bda72326e7f
SHA5122e3043f641aedd58a3e78c0b06b4754d06e9437613e79a3893144918c67e30dd08b9fcb3ab551c6cc687d951a6fb359e05854c24013e08f44e37f2185c0f286f
-
Filesize
5KB
MD5fd4e133822693eb52e598394883bc5d3
SHA187b510491c4d7f40cfdd9bc9fabb285911c8cd6a
SHA2566696aca0062d3b9c0a4477d7d921e20648a563871f0cb9bbffd04bda72326e7f
SHA5122e3043f641aedd58a3e78c0b06b4754d06e9437613e79a3893144918c67e30dd08b9fcb3ab551c6cc687d951a6fb359e05854c24013e08f44e37f2185c0f286f
-
Filesize
5KB
MD5fd4e133822693eb52e598394883bc5d3
SHA187b510491c4d7f40cfdd9bc9fabb285911c8cd6a
SHA2566696aca0062d3b9c0a4477d7d921e20648a563871f0cb9bbffd04bda72326e7f
SHA5122e3043f641aedd58a3e78c0b06b4754d06e9437613e79a3893144918c67e30dd08b9fcb3ab551c6cc687d951a6fb359e05854c24013e08f44e37f2185c0f286f
-
Filesize
6KB
MD541b784d32bdc8d6e9ab06044dc4ba8e1
SHA103d624736e5d7d20d918c73cf378b882b14b01e6
SHA256072889b8bde4dc9cdcd407f582ab186b7b66b8b44d5b2ff4d73509373b61c8ac
SHA5128998757fb8e89e6b5838de5d23a09e9501841c7d2106827eaf5ca7342a370608f7b1bfa0c0d3ab9d56940f7cb7151ab7a2943d3c7d0482bfa69d78034ec9d28c
-
Filesize
6KB
MD541b784d32bdc8d6e9ab06044dc4ba8e1
SHA103d624736e5d7d20d918c73cf378b882b14b01e6
SHA256072889b8bde4dc9cdcd407f582ab186b7b66b8b44d5b2ff4d73509373b61c8ac
SHA5128998757fb8e89e6b5838de5d23a09e9501841c7d2106827eaf5ca7342a370608f7b1bfa0c0d3ab9d56940f7cb7151ab7a2943d3c7d0482bfa69d78034ec9d28c
-
Filesize
6KB
MD5d0ba3cf85ba47f5d9922f0c32d99860e
SHA17d32c1cfb81af729a8bac02e770c9f57773d20b4
SHA256e64b365015450e74463f45b2e0253b09c2f62851b80f9153f0a1193de4d864fa
SHA512255003e30bcb9997acb2ea039400b9a4d00aa060572ba27df44b04c150bb706cb5c73b5eb25adbe09732dd523e2f68d6f1b94388ff636b6500cb1d0b4d07bdf8
-
Filesize
6KB
MD5d0ba3cf85ba47f5d9922f0c32d99860e
SHA17d32c1cfb81af729a8bac02e770c9f57773d20b4
SHA256e64b365015450e74463f45b2e0253b09c2f62851b80f9153f0a1193de4d864fa
SHA512255003e30bcb9997acb2ea039400b9a4d00aa060572ba27df44b04c150bb706cb5c73b5eb25adbe09732dd523e2f68d6f1b94388ff636b6500cb1d0b4d07bdf8
-
Filesize
6KB
MD557c8a08087f8cd8af7c3619c8f4fe656
SHA176894f8061e0a49c9ffde341596ed75ee8a44ea3
SHA2566cb7c415a7bf4acd065d43d3e2112eee42c88315ebeabd6d0c94504d29aaa161
SHA5127633fe56cbc63e90e7cb46c5435e87296b8283e80f3ced8bd1a6c2e733609ebabc2a5c2b4baab458068ffdbe594309e71eb96e5295e6439590f8b09ce600082f
-
Filesize
6KB
MD5c3734da55f3c295e4a69574b8809e7e8
SHA11fd42212d808d96c483ca28b61a6b288d2ba7e5d
SHA2567bff0a134b3ce7f89e85b9d937e9bc39f2fcf8ec1cc36995a7b26da987fc4509
SHA512a95b0c2a3dacd27955f0f0dcc39be3a79f658a17e8b616f9dedaa740ebe49771dbfbdf000b49d607633b8e5488938b7af3bc81b2dd346cc2b1cdc2e75d7b692c
-
Filesize
6KB
MD5c3734da55f3c295e4a69574b8809e7e8
SHA11fd42212d808d96c483ca28b61a6b288d2ba7e5d
SHA2567bff0a134b3ce7f89e85b9d937e9bc39f2fcf8ec1cc36995a7b26da987fc4509
SHA512a95b0c2a3dacd27955f0f0dcc39be3a79f658a17e8b616f9dedaa740ebe49771dbfbdf000b49d607633b8e5488938b7af3bc81b2dd346cc2b1cdc2e75d7b692c
-
Filesize
6KB
MD5c3734da55f3c295e4a69574b8809e7e8
SHA11fd42212d808d96c483ca28b61a6b288d2ba7e5d
SHA2567bff0a134b3ce7f89e85b9d937e9bc39f2fcf8ec1cc36995a7b26da987fc4509
SHA512a95b0c2a3dacd27955f0f0dcc39be3a79f658a17e8b616f9dedaa740ebe49771dbfbdf000b49d607633b8e5488938b7af3bc81b2dd346cc2b1cdc2e75d7b692c
-
Filesize
6KB
MD5c3734da55f3c295e4a69574b8809e7e8
SHA11fd42212d808d96c483ca28b61a6b288d2ba7e5d
SHA2567bff0a134b3ce7f89e85b9d937e9bc39f2fcf8ec1cc36995a7b26da987fc4509
SHA512a95b0c2a3dacd27955f0f0dcc39be3a79f658a17e8b616f9dedaa740ebe49771dbfbdf000b49d607633b8e5488938b7af3bc81b2dd346cc2b1cdc2e75d7b692c
-
Filesize
6KB
MD5dcfd9f407555ffd417749095a61894e7
SHA1a5e4af9b5818d7ff7ab6150517bf05a009868e56
SHA25622575e6a126efd0b4cde826121b1269db1d4f2285cef81f3a76115c871232d5a
SHA5125be2c7c2cadb119eb2f551e263552cf275b414d09f364b0ce31976a9aa30f75f80db13d16ef665d6737e7ec7bf6bb905be81d038c28f0066995233358e11881f
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB