Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
16/03/2023, 00:06
General
-
Target
AnyDesk.exe
-
Size
3.8MB
-
MD5
e546506082b374a0869bdd97b313fe5d
-
SHA1
082dc6b336b41788391bad20b26f4b9a1ad724fc
-
SHA256
fc19f3275d02764cf249dc6fe8962e06b83a4f5769cc369bc4f77b90c567df18
-
SHA512
15a8d7c74193dffd77639b1356ccbe975d17de73d0d6d177b8ecf816d665f620adefcded37c141bac0b2d8564fbba61aca4d9b01885740f23fbcc190515cbd08
-
SSDEEP
98304:uSCb8xJlb0VgU/vZaZKa4opQILfbsLajDMWEeq7PbUs6En5:uH8HCOUZakpAbjbsLsMmqM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 33 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c04b2e1d086503cfca058a358be3c430
SHA1e9f41c9664180b4fcd81a35ca69cdb9d49a6d094
SHA256e881597835580460ead7ee1473da6e4321449a454e3ce5d6138579c3c14eafd7
SHA51293e1738013cb25f80529b236ab664ca517a26c32ebaa0c4c86752aa7c42352dbeccfe594eea740d2109702b7b5fe6cd93617f8a3906be636666cd8c108a1c509
-
Filesize
7KB
MD5c04b2e1d086503cfca058a358be3c430
SHA1e9f41c9664180b4fcd81a35ca69cdb9d49a6d094
SHA256e881597835580460ead7ee1473da6e4321449a454e3ce5d6138579c3c14eafd7
SHA51293e1738013cb25f80529b236ab664ca517a26c32ebaa0c4c86752aa7c42352dbeccfe594eea740d2109702b7b5fe6cd93617f8a3906be636666cd8c108a1c509
-
Filesize
2KB
MD5cdc5f542da63a5576316e85b933a887a
SHA1533bef48ff1325fed222ca7ebe283f8bac137dfc
SHA256c4b733e2e1a763c26dc2022aaff8e8a115b781dbb7790eb2ba2396fa2ddbb3f9
SHA5126a21a4a6dbfa0ca483eb64858aaed9c48a04e9f306a8cc9b8dcb88fdedd30ee799318baa451798d0690b7796be76a25e6a23846ce8453a8f257ef07d7fac7562
-
Filesize
2KB
MD5cdc5f542da63a5576316e85b933a887a
SHA1533bef48ff1325fed222ca7ebe283f8bac137dfc
SHA256c4b733e2e1a763c26dc2022aaff8e8a115b781dbb7790eb2ba2396fa2ddbb3f9
SHA5126a21a4a6dbfa0ca483eb64858aaed9c48a04e9f306a8cc9b8dcb88fdedd30ee799318baa451798d0690b7796be76a25e6a23846ce8453a8f257ef07d7fac7562
-
Filesize
424B
MD5724c1b931cfb6bd4c01b39a7c4b14ca3
SHA10f69c43c049dd14d16b266dfd49e1c773b208170
SHA256f510515ef635942776b6ded5805ee2a980b88ed25c23f8ef2a8e17285ceeaac1
SHA51299e3cc6953a2b7f6495f505168bd3f52f46831cd27930631dba01247234e63b8d2f55609e088f5f1207a30bd94052ad4605597ff96b9feb99b2b6e3f58d8607c
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD5724c1b931cfb6bd4c01b39a7c4b14ca3
SHA10f69c43c049dd14d16b266dfd49e1c773b208170
SHA256f510515ef635942776b6ded5805ee2a980b88ed25c23f8ef2a8e17285ceeaac1
SHA51299e3cc6953a2b7f6495f505168bd3f52f46831cd27930631dba01247234e63b8d2f55609e088f5f1207a30bd94052ad4605597ff96b9feb99b2b6e3f58d8607c
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD5724c1b931cfb6bd4c01b39a7c4b14ca3
SHA10f69c43c049dd14d16b266dfd49e1c773b208170
SHA256f510515ef635942776b6ded5805ee2a980b88ed25c23f8ef2a8e17285ceeaac1
SHA51299e3cc6953a2b7f6495f505168bd3f52f46831cd27930631dba01247234e63b8d2f55609e088f5f1207a30bd94052ad4605597ff96b9feb99b2b6e3f58d8607c
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD5724c1b931cfb6bd4c01b39a7c4b14ca3
SHA10f69c43c049dd14d16b266dfd49e1c773b208170
SHA256f510515ef635942776b6ded5805ee2a980b88ed25c23f8ef2a8e17285ceeaac1
SHA51299e3cc6953a2b7f6495f505168bd3f52f46831cd27930631dba01247234e63b8d2f55609e088f5f1207a30bd94052ad4605597ff96b9feb99b2b6e3f58d8607c
-
Filesize
424B
MD590ae06fbfb3da085964dd0ac0956eafb
SHA1a97a3b85891e135b7866acdac8aa55c39136b6e7
SHA256833cac107cbfc2310e1e6bb7175d31801e5f4422ff725ff43fc3e4b01887a2b7
SHA512ce92ed99cce845976d80be956d8beb8d53b061916b0e9d1b766de40275e8e358c0dff045e4c6fb3f4af989585117d8a165c41303e9fb3241cec03335643f8127
-
Filesize
424B
MD5724c1b931cfb6bd4c01b39a7c4b14ca3
SHA10f69c43c049dd14d16b266dfd49e1c773b208170
SHA256f510515ef635942776b6ded5805ee2a980b88ed25c23f8ef2a8e17285ceeaac1
SHA51299e3cc6953a2b7f6495f505168bd3f52f46831cd27930631dba01247234e63b8d2f55609e088f5f1207a30bd94052ad4605597ff96b9feb99b2b6e3f58d8607c
-
Filesize
424B
MD5724c1b931cfb6bd4c01b39a7c4b14ca3
SHA10f69c43c049dd14d16b266dfd49e1c773b208170
SHA256f510515ef635942776b6ded5805ee2a980b88ed25c23f8ef2a8e17285ceeaac1
SHA51299e3cc6953a2b7f6495f505168bd3f52f46831cd27930631dba01247234e63b8d2f55609e088f5f1207a30bd94052ad4605597ff96b9feb99b2b6e3f58d8607c
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
1KB
MD55f233bf42bce9470ed7cd1286113be5e
SHA1528891b54f352de37ec0ca99e96c3b50270e6955
SHA256f21afcc1f17697faf427f7d812c4f1951d8c037cd9b75afb8ed131a708eee92e
SHA512848a2a0f2c5a8b093a82837b9c2010eac450245fd5f25c39af5d9ffd521cac8a5178c58d0889cb38aa9c68118bc58198bc33280195bd55d2e314a7894448caed
-
Filesize
1KB
MD55f233bf42bce9470ed7cd1286113be5e
SHA1528891b54f352de37ec0ca99e96c3b50270e6955
SHA256f21afcc1f17697faf427f7d812c4f1951d8c037cd9b75afb8ed131a708eee92e
SHA512848a2a0f2c5a8b093a82837b9c2010eac450245fd5f25c39af5d9ffd521cac8a5178c58d0889cb38aa9c68118bc58198bc33280195bd55d2e314a7894448caed
-
Filesize
1KB
MD55f233bf42bce9470ed7cd1286113be5e
SHA1528891b54f352de37ec0ca99e96c3b50270e6955
SHA256f21afcc1f17697faf427f7d812c4f1951d8c037cd9b75afb8ed131a708eee92e
SHA512848a2a0f2c5a8b093a82837b9c2010eac450245fd5f25c39af5d9ffd521cac8a5178c58d0889cb38aa9c68118bc58198bc33280195bd55d2e314a7894448caed
-
Filesize
1KB
MD529cee1e85a3df05bd1e9eff62c14169d
SHA18dc4ed78721926bfc1e3f0b0d942d3ef91bf21f4
SHA256db48de99fd71ddddbb2e41279138cf8981fa6d4f9820435c77eb8b99dc314c4d
SHA512f6d750a7bc7636a90b4eb2ceb2ebc20cfb7fb09621d0d8899e03026063e323111498e0d62f3c6e0c039cba37e15a92486b05cc02d4a43517c30933edb53e7a38
-
Filesize
1KB
MD5ddf2bfd90c2c8ea070f7a4bb6169fb33
SHA15a54f5757ba79a86f4361b05f54c07ba1d69f133
SHA256792ece9e3a6e839b4a9bb1c7d28c98a710a4fceb67ac9465758e667ddaddf753
SHA512e57c6e407f4736a44fe009d5ac45350fe3711efb19d6ba34b5f7c82e5afd44c16ca0d0a0ea8318467336b04cb0c5f713bed6b53a69b978d3c157063b50f25454
-
Filesize
1KB
MD5ddf2bfd90c2c8ea070f7a4bb6169fb33
SHA15a54f5757ba79a86f4361b05f54c07ba1d69f133
SHA256792ece9e3a6e839b4a9bb1c7d28c98a710a4fceb67ac9465758e667ddaddf753
SHA512e57c6e407f4736a44fe009d5ac45350fe3711efb19d6ba34b5f7c82e5afd44c16ca0d0a0ea8318467336b04cb0c5f713bed6b53a69b978d3c157063b50f25454
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB