Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
64s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
AnyDesk (DROPSY).exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
AnyDesk (DROPSY).exe
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
AnyDesk (DROPSY).exe
-
Size
8.4MB
-
MD5
473a3c8d7f09e0c24ceedcb639fc3d93
-
SHA1
df560493b628b30b43e9ed71e1c419a9465690f6
-
SHA256
f0c95b09ead49d1fe42e25f6d4f8bbcd3492d28c8f508e45e59feb31f4011c3e
-
SHA512
28e7d47cc85633742139e2188161f1104190e6259eb3b4f274fb3cc7a1a91b6f9a37c804c7a744b4b2feba77b6b6e5c3bcf67aa22a9e29d69152202d9337aa53
-
SSDEEP
196608:abstwhbd7KSM/cVBP6uYLDYKFlhbstwhbd7KSM/cVB:abstahKSzVBSrL0ObstahKSzVB
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3716 AnyDesk (DROPSY).exe -
Obfuscated with Agile.Net obfuscator 32 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/3716-146-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-147-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-149-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-151-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-153-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-155-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-157-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-159-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-161-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-163-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-165-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-167-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-169-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-171-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-173-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-175-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-177-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-179-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-181-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-183-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-185-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-187-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-189-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-191-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-193-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-195-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-197-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-199-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-201-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-203-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-205-0x0000000007100000-0x0000000007335000-memory.dmp agile_net behavioral2/memory/3716-207-0x0000000007100000-0x0000000007335000-memory.dmp agile_net -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3716 AnyDesk (DROPSY).exe Token: SeDebugPrivilege 2168 taskmgr.exe Token: SeSystemProfilePrivilege 2168 taskmgr.exe Token: SeCreateGlobalPrivilege 2168 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe 2168 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AnyDesk (DROPSY).exe"C:\Users\Admin\AppData\Local\Temp\AnyDesk (DROPSY).exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3716
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2168
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
Filesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b