Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16-03-2023 00:06
General
-
Target
AnyDesk.exe
-
Size
3.8MB
-
MD5
e546506082b374a0869bdd97b313fe5d
-
SHA1
082dc6b336b41788391bad20b26f4b9a1ad724fc
-
SHA256
fc19f3275d02764cf249dc6fe8962e06b83a4f5769cc369bc4f77b90c567df18
-
SHA512
15a8d7c74193dffd77639b1356ccbe975d17de73d0d6d177b8ecf816d665f620adefcded37c141bac0b2d8564fbba61aca4d9b01885740f23fbcc190515cbd08
-
SSDEEP
98304:uSCb8xJlb0VgU/vZaZKa4opQILfbsLajDMWEeq7PbUs6En5:uH8HCOUZakpAbjbsLsMmqM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5cf627471f17d49b3bee6cdabdf75b968
SHA109ad7fd302b848f112cbf229a0a9ed9905d5d2a1
SHA256e1a34160c6d27e996cc6538e7e1e799537452856233c8d455cf403c742a3e70b
SHA512e9caa15348bcd9da278de10a0c8a75cafad8b3ddb91e0e47ec1609346fcca1292607e10f3e600056f16affb1c762fb4811bd0fda59a43550da9932b6ec0bd6da
-
Filesize
9KB
MD5d4bc500dd654f62b6af0806b8c9a7abc
SHA1d9a51f6bc3b800da52ef96302ca2c2d2ab787c60
SHA25682f253a8550fac6ca852433f528ec7a39a501b1ab4fef6dda91985193b883017
SHA512877a92fdd773b250212e1bb67d0cbacce5767b8843f206c8bd3e08d5a78f1033e33f6a71cfeb34fe8303747b910c6f4a7e47b6c00ae279b1795074972c0d22a0
-
Filesize
2KB
MD53a94358a3c97da8415d530d4faad7794
SHA1ee6d14a8c5a6c58a6a33f30b1883a92c6d64641b
SHA256268b8c2bb53bbeb9eee848920f2a4d9f5a708650ccc6c1a5a4362462752b1744
SHA512932f332db56080e438fe8ecbbb2e619eb69f2e4a58641ba8d6e3edb9b71d523a70d201f02e3507b9e5151b04988c1984931c072152c943daa834307d08ca937d
-
Filesize
2KB
MD53a94358a3c97da8415d530d4faad7794
SHA1ee6d14a8c5a6c58a6a33f30b1883a92c6d64641b
SHA256268b8c2bb53bbeb9eee848920f2a4d9f5a708650ccc6c1a5a4362462752b1744
SHA512932f332db56080e438fe8ecbbb2e619eb69f2e4a58641ba8d6e3edb9b71d523a70d201f02e3507b9e5151b04988c1984931c072152c943daa834307d08ca937d
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
424B
MD5191a3f6f21fbb31e9ae443de32531ac2
SHA136b94bb464eaef4d6e2d81bf2ba149e13d3821a4
SHA2569420883a129f8aef69b48ec84ffdcbad40ef1babdb95e059c123f9ff151f3d36
SHA5126ab2c6ca9ff3d18fc1095151dd0dc2761ee912bcc8e94ed1f7daf70b8535fe865a647c2b92bc1b5dad9d21be1032b1d7c9a408e116f2f49bf14e046558ba5eeb
-
Filesize
424B
MD59431f76d5d98bc3960de446e22b631e7
SHA103067581416f37d7c9a66083877bdacb84aa580c
SHA256aeb57ee23f15f5839c86a9e941681227b4d9c7cb39315e7f17cd04e347b401a6
SHA512eeb475a703dfdc0b7b51e1c30d59a8104b4672b24a10b63ca1fb180bf723881036b6195f257ffbb08571ee4a06b3c44ebfdd86e0ad30eb17ea619f1c6559c12f
-
Filesize
1KB
MD58c4fa64b8cd192de3d3842dc060011ec
SHA194172c79f204c8ed67b5d4b754a76a79e6fa65a2
SHA2565ba12d176387adc005143a2c62d226e58193d987ff582a4ca9f2688284f99490
SHA512f080fb4ec6b29ed725e6c6225a7064e2f297cb6f578bf11035a97f3d982826593665a2a8aa97bec191648a13ac893a5c0ba07e95a763691e0f65c52cff9e70ca
-
Filesize
1KB
MD51fc0b70dfd7e62fad222d31302403396
SHA1ef67661fce026ba2cce4a7f228c005fa6d934d65
SHA25601f1a6765b8501a6a50ab5b9617f508138bf4aacd060f77e72110bd823f9138b
SHA512edd97f80bd46b998c68513e649ccadbb639710ccba1c8ea62c3eacb0ca7957efbec41edc5c78e2f5567b68267f792ac64575318e2e97cf11eac38f564de7a7c6
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD51d1be4d02f9c01288f3ed3015e859b0f
SHA14d469bd76a0233f413762322e59465c8ad9cb970
SHA25684f4945a6cd74cd54beaa722ea277b7229bc6f368254fcae7f7b2f681c02c27c
SHA512089756da63032ece6fee573ff68d6e51a08563c1c67e2749608bd153aa821439735e88be25ec4983f62c017964eab572c4f601dd6480f085b3f545bbae3da5f5
-
Filesize
1KB
MD5e44017cf9e14ca5f4eac1374cadcb01b
SHA1bafb87165c04761c165682c617bf7100d24114c9
SHA25690a384c115ef3a2adcd7f0d162929bb58c6a7ad91545ce895ca228054a8b3f0b
SHA51223eba00fb83d684e9e875a3880aca71089690c067ba3045e820038d55bf9baf96d2ca5c3b55856f133fe84796ca6b1695107ffbb030f3e5975d1306be135d148
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
4KB
-
Filesize
16.5MB
-
Filesize
16.5MB
-
Filesize
16.5MB